Multiple reports from **Kaspersky** reveal that Russian enterprises are the primary targets of three distinct threat activity clusters: **NightEagle**, **Hacking Cat**, and **Toy Ghouls**. ## NightEagle: Advanced Persistence and Lateral Movement **NightEagle** (also known as APT-Q-95), a threat actor active since at least 2023, has been observed employing new techniques for persistence and lateral movement. According to **Kaspersky**, attackers often gain initial access through compromised valid credentials to corporate VPNs, with connections originating from Russian IP addresses linked to **Cloudflare WARP** tunnels and European virtual infrastructure providers.  These attacks involve deploying **GhostContainer**, a modular backdoor that grants full access to **Microsoft Exchange Servers**, allowing operators to execute arbitrary code, perform file operations, and load additional modules. To evade detection, **GhostContainer** masquerades as a common server component and can function as a traffic redirection or tunnel. Previous attacks leveraging this malware have targeted government agencies and high-tech companies in Asia. **GhostContainer** integrates components from several open-source projects, including the **Neo-reGeorg** tunnel, an exploit for **CVE-2020-0688**, and the **GhostWebShell** class from the **ysoserial** utility—all publicly available on **GitHub**. While the exact delivery method for **GhostContainer** to **Microsoft Exchange Servers** remains unknown, it's believed to involve extracting cryptographic keys from the **ASP.NET** configuration, overwriting the **VIEWSTATE** framework parameter, and injecting a payload to launch the backdoor in memory. For lateral movement, **NightEagle** downloads tunneling tools to redirect network traffic via RDP using **Microsoft dev tunnels** and the open-source program **rdp2tcp**. The group also exploits various vulnerabilities in **Active Directory** to gain elevated privileges, including **CVE-2019-0708** (aka **BlueKeep**) to create local administrative accounts, and executes **DCSync** attacks to impersonate domain controllers. The ultimate objective for **NightEagle** is to establish persistence, obtain password hashes for domain accounts, leverage long-lived **Kerberos** tickets for legitimate resource access, and ultimately compromise domain controllers and the entire **Active Directory** infrastructure. ## Pro-Ukrainian Hacking Cat: Shifting to Destructive Attacks **Hacking Cat**, a pro-Ukrainian hacktivist entity, has historically engaged in website defacements and data breaches since February 2024. However, the group has recently shifted its tactics towards encryption and destructive attacks. **Kaspersky** notes that **Hacking Cat** collaborates with other hacktivists like **Cyber Anarchy Squad** and the **Ukrainian Cyber Alliance**, complicating tool attribution. Their attacks weaponize vulnerabilities in **Exchange servers**, such as **CVE-2021-26855** and **CVE-2026-42897**, to deliver a Go-based Remote Access Trojan (RAT) called **Gorilla RAT**. This RAT can tunnel traffic, allowing operators to access internal networks, run arbitrary commands, enumerate processes, gather system information, and manage files. **Hacking Cat** also deploys multiple variants of the **Monkey ransomware** family, written in Rust, .NET, C++, and Golang, targeting Windows, Linux, and **VMware ESXi** systems. The earliest **Monkey ransomware** artifact dates back to late summer 2025. The malware terminates unnecessary processes and inhibits system recovery before encryption. A Rust-based variant of **Monkey Ransomware** encrypts files using **ChaCha20-Poly1305**. Some variants omit storing the encryption key, effectively turning them into wiper malware despite leaving a ransom note. Other variants store the key but lack contact information. Other variants exhibit diverse functionalities: * **The .NET variant** generates a 32-byte key, sends it to the C2 server, and encrypts files using **AES-256-CBC**. It can escalate privileges, disable Windows recovery, extract **Microsoft Outlook** credentials, delete backup files, and self-delete after execution. * **The C++ variant** establishes persistence via scheduled tasks or a **RunOnce** registry key, clears system logs, disables logging, wipes PowerShell and Windows Command Prompt history, bypasses **AMSI**, turns off **ETW**, configures **Microsoft Defender** exclusions, modifies the Registry to disable Task Manager and Command Prompt, obtains public IP addresses, and disables backup and recovery mechanisms, including the **Volume Shadow Copy Service (VSS)**. * **The Golang variant**, primarily targeting Linux and ESXi, establishes persistence via **crontab**, disables **SELinux** and **AppArmor**, and attempts to delete volume shadow copies. **Kaspersky** theorizes that the inclusion of shadow copy deletion functionality in Linux/ESXi versions, where it serves no purpose, suggests carelessness or possible AI development of the toolkit. **Hacking Cat** has also collaborated with **Cyber Anarchy Squad** to distribute the **ClearWater** ransomware via a batch script, believed to be part of a Ransomware-as-a-Service (RaaS) model for pro-Ukrainian hacktivist groups. In another joint operation with the **Ukrainian Cyber Alliance**, they deployed **Nemo Wiper**, which overwrites files with random bytes and fills free disk space. **Kaspersky** notes that the use of common self-written tools by different hacktivist groups suggests a shared source or developer. However, **Hacking Cat** refuted some of **Kaspersky's** attributions on their Telegram channel, stating, "a couple of the tools are ours, but the lockers are definitely not," and urged **Kaspersky** to "learn to reverse-engineer groups better." ## Toy Ghouls: Debut of a Custom Backdoor Rounding out the list of groups targeting Russian organizations, **Toy Ghouls** has been observed deploying a custom backdoor for the first time.