Kaspersky: Three Groups Are Attacking Russian Companies — Backdoors, Ransomware and Wipers

Kaspersky Lab has published a series of reports on three groups that have singled out Russian enterprises as their targets. Their approaches differ markedly — from quiet persistence for espionage to overtly destructive operations.

NightEagle: quiet persistence in Active Directory

The NightEagle group (also known as APT-Q-95) has been active since at least 2023. According to the researchers, the attackers logged into corporate VPNs using stolen legitimate credentials — the connections came through Cloudflare WARP tunnels from the Russian segment and from European virtual hosting sites. A modular backdoor called GhostContainer, assembled from public GitHub projects (the Neo-reGeorg tunnel, the CVE-2020-0688 exploit and the GhostWebShell class from ysoserial) and disguised as a standard server component, was deployed onto Microsoft Exchange servers.

To move across the network they used RDP tunneling (Microsoft dev tunnels, rdp2tcp) and the exploitation of Active Directory vulnerabilities, including BlueKeep (CVE-2019-0708) and the DCSync attack. The ultimate goal was to seize the domain controllers and the entire directory infrastructure.

Hacking Cat: from defacements to encryption

The pro-Ukrainian hacktivist group Hacking Cat has been known since February 2024 for breaking into and defacing websites, but recently it has moved on to encrypting and destroying data. Through Exchange vulnerabilities it delivers the Go-written Gorilla RAT trojan, as well as the Monkey ransomware family — versions in Rust, .NET, C++ and Go strike Windows, Linux and VMware ESXi.

Some Monkey variants store the encryption key nowhere at all, effectively turning into wipers, even though they still leave a ransom note. A curious detail: the Go version for Linux and ESXi tries to delete Windows Volume Shadow Copies — a function that makes no sense in those environments. Analysts suggest that the developers were careless and probably used AI when building the toolkit.

In response, Hacking Cat stated on its Telegram channel that some of the tools were indeed its own, but “the lockers are definitely not ours,” and advised Kaspersky to “learn to reverse-engineer groups better.”

Toy Ghouls: communication via MQTT and the Element messenger

The financially motivated group Toy Ghouls (Bearlyfy, Feral Wolf), active since 2025, has traveled a path from the leaked Babuk and LockBit builders to its own GenieLocker ransomware, and now to a self-written backdoor called Bird Agent. It is delivered via WinRM using Evil-WinRM and WinRM-fs.

Its command channels are original: one variant communicates with the operator through a HiveMQ MQTT broker, another through Element, based on the Matrix protocol. The backdoor’s configuration is encrypted with a key tied to the MachineGuid of the specific machine, so it will not decrypt on another system. The move away from public open-source projects toward non-standard channels, the company notes, points to the group’s aim of complicating attacks and remaining undetected for longer.

Source: The Hacker News