Ethical Hacking News
Three sophisticated threat groups have been identified as targeting Russian enterprises with backdoors, ransomware, and wipers. NightEagle, Hacking Cat, and Toy Ghouls have been involved in a coordinated effort to compromise the security of Russian organizations, leaving their systems vulnerable to exploitation. The attackers used a range of malicious tools, including GhostContainer, Gorilla RAT, and Monkey Ransomware, to gain access to corporate VPNs, deliver malware, and encrypt victim files. The groups have been observed collaborating with other hacktivists and using custom-built tools to evade detection. The attack on Russian enterprises is a concerning development in the cybersecurity landscape, highlighting the importance of robust security measures to protect against such threats.
Three threat groups, NightEagle, Hacking Cat, and Toy Ghouls, have been targeting Russian enterprises with malicious tools, including backdoors, ransomware, and wipers. NightEagle has been using new techniques for persistence and lateral movement to gain access to corporate VPNs, often using compromised valid credentials. The GhostContainer backdoor granted complete access to Microsoft Exchange Servers and ran arbitrary code, performing file operations and loading additional modules. Hacking Cat weaponized vulnerabilities in Exchange servers to deliver a remote access trojan dubbed Gorilla RAT, which established a connection with a remote server and ran arbitrary commands. The Monkey ransomware family, written in various languages, targeted Windows, Linux, and VMware ESXi systems, with different variants offering persistence, encryption, and other functionalities. Toy Ghouls, a financially motivated group, used a bespoke backdoor, the Bird Agent, which used Windows Remote Management (WinRM) to deliver the backdoor to compromised systems. The attack campaign highlighted the use of custom-built tools, unconventional channels for communication with C2 servers, and the shift away from publicly available open-source projects.
The cybersecurity landscape has recently been shaken by the revelation of three threat groups that have been actively targeting Russian enterprises with a multitude of malicious tools, including backdoors, ransomware, and wipers. According to reports from Kaspersky, a leading cybersecurity vendor, these groups, identified as NightEagle, Hacking Cat, and Toy Ghouls, have been employed in a coordinated effort to compromise the security of Russian organizations, leaving their systems vulnerable to exploitation.
NightEagle, a threat actor known to be active since at least 2023, has been observed using new techniques for persistence and lateral movement to gain access to corporate VPNs. In most incidents, the attackers utilized compromised valid credentials to gain access to these systems. The attackers used IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as IP addresses associated with European virtual infrastructure providers, to deliver the malware.
The GhostContainer, a known modular backdoor, was used to grant the operators complete access to a victim's Microsoft Exchange Server, as well as run arbitrary code, perform file operations, and load additional modules. To sidestep detection, the malware masqueraded as a common server component to blend in with regular operations. It could also function as a traffic redirection or tunnel. Prior attacks involving the malware targeted a government agency and a high-tech company located in Asia.
The attacks carried out by NightEagle incorporated components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility. All of these components were publicly available on GitHub. The exact method used by the attackers to deliver GhostContainer to Microsoft Exchange servers is unknown, although it is believed to have involved the extraction of cryptographic keys used by the server from the ASP.NET configuration, followed by overwriting the VIEWSTATE framework parameter, and injecting a payload into it, causing the backdoor to be launched in memory.
To move laterally within the internal network, NightEagle had been observed downloading tunneling tools to redirect network traffic via RDP using Microsoft dev tunnels and an open-source program called rdp2tcp. The attackers exploited various vulnerabilities in Active Directory to obtain elevated privileges and move laterally through the network. This included the exploitation of the CVE-2019-0708 (aka BlueKeep) to create a local account on the system and add it to the Administrators and Remote Desktop Users groups.
Furthermore, the attackers attempted to impersonate the domain controller by means of a DCSync attack. The end goal of NightEagle was to establish persistence in the victim infrastructure, obtain password hashes for domain accounts, use long-lived Kerberos tickets to gain legitimate access to target resources, and ultimately break into domain controllers and the victim's entire Active Directory infrastructure.
The second group to single out Russian enterprises was Hacking Cat, a pro-Ukrainian hacktivist entity with a history of conducting website defacements and data breaches since February 2024. In recent months, however, the group had shifted its tactics and pivoted to encryption and destructive attacks. Hacking Cat actively collaborated with other hacktivists, such as Cyber Anarchy Squad and the Ukrainian Cyber Alliance, which complicated the attribution of tools to specific attackers.
Attacks mounted by Hacking Cat weaponized vulnerabilities in Exchange servers, such as CVE-2021-26855 and CVE-2026-42897, to deliver a Go-based remote access trojan dubbed Gorilla RAT. This malware established a connection with a remote server, registered the victim, and awaited further instructions that allowed it to run arbitrary commands, enumerate processes, gather system information, upload/download files, and open or close a TCP tunnel.
The malware also delivered multiple variants of a ransomware family dubbed Monkey, which were written in Rust, .NET, C++, and Golang to target Windows, Linux, and VMware ESXi systems. The earliest Monkey ransomware artifact dated back to late summer 2025. The malware took steps to terminate unnecessary processes and inhibit system recovery before starting the encryption process.
A Rust-based variant of Monkey Ransomware generated a 32-byte key and encrypted the victim's files using ChaCha20-Poly1305. Some variants did not store the key anywhere, which effectively turned them into full-fledged wiper malware, yet they still left a ransom note. Other variants stored the key but did not include any contact information in the note.
The .NET variant of Monkey Ransomware generated a 32-byte key, sent it to the command-and-control (C2) server, and encrypted the victim's files using AES-256-CBC. It was equipped to escalate privileges and disable Windows recovery mechanisms, extract Microsoft Outlook credentials and send them to the C2 server, delete files with .bak, .backup, .bkf, .bck extensions, and remove itself after execution.
The C++ variant of Monkey Ransomware offered similar functionality but could establish persistence via a scheduled task or a RunOnce registry key. It cleared system logs, disabled logging, wiped PowerShell Command History and Windows Command Prompt, bypassed AMSI, turned off Event Tracing for Windows (ETW), configured Microsoft Defender exclusions for the encryptor, made Registry modifications to disable Task Manager and Windows Command Prompt, obtained the public IP address by querying api.ipify[.]org and ipapi[.]co, and disabled a number of backup, database, and recovery mechanisms, including the Volume Shadow Copy Service (VSS).
The Golang variant of Monkey Ransomware, which primarily targeted Linux and ESXi systems, established persistence via a crontab entry, disabled SELinux and AppArmor, and attempted to delete volume shadow copies. This version also included functionality for removing shadow volume copies, which served no purpose in Linux and ESXi environments and suggested that the attackers were careless and likely used AI in developing the toolkit.
Hacking Cat had also been observed teaming up with the Cyber Anarchy Squad, another pro-Ukrainian hacktivist group, to deliver a different ransomware strain known as ClearWater by means of a batch script. ClearWater was assessed to be distributed under a ransomware-as-a-service (RaaS) to pro-Ukrainian hacktivist crews.
In another collaborative operation with the Ukrainian Cyber Alliance, the threat actor was said to have deployed a wiper malware called Nemo Wiper that overwrote files with random bytes and filled the remaining free disk space with files containing random alphanumeric names and the .lock extension. Kaspersky noted that different hacktivist groups were using the same self-written tools in different attacks, including multi-stage infection chains, which may indicate the existence of a common source for such tools – for example, a developer or a small group of developers who create, maintain, and modify the malware, which was subsequently used by various hacktivist groups.
However, following the publication of the report, Hacking Cat posted on its Telegram channel that "a couple of the tools are ours, but the lockers are definitely not." It also alleged that Kaspersky was attributing tools from completely unrelated actors to them and that it should "learn to reverse-engineer groups better."
The third group to target Russian enterprises was Toy Ghouls, which had moved from using leaked Babuk and LockBit ransomware builders to its own custom GenieLocker ransomware and now to a bespoke backdoor. The financially motivated group was known to be active since 2025.
The backdoor, first detected in July 2026, appeared in two variants - mqtt-bird-agent 0.1.0, which used HiveMQ MQTT broker for C2, and matrix-bird-agent 0.1.0, which used Element, a Matrix-based end-to-end encrypted messenger app, for C2. The attackers used Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems.
In this campaign, the attackers used open-source tools such as Evil-WinRM and WinRM-fs to do this. The Bird Agent backdoor could run within an interactive command-line session, as well as set up persistence as a Windows service. Once launched, it looked for a configuration file ("config.toml") in the same directory from where it was located. Alternatively, the full path to the file could be specified via the "-c" or "--config" option while running it.
The malware then proceeded to read the file and partially encrypted it with a key derived from the victim machine's MachineGuid value stored in the Windows Registry so that the configuration was bound to that specific system. The backdoor stopped execution if it could not decrypt the configuration on subsequent runs.
The configuration, depending on the variant used, contained either the cluster identifier used to communicate with the HiveMQ MQTT broker or the Element internal room identifier along with the access token necessary to access that room. If this parameter was empty, the backdoor was designed to prompt for the token during installation, after which it got stored.
Once the connection was established, the backdoor proceeded to send system information and issue HTTP GET requests to the HiveMQ broker to fetch commands from the C2 server, execute them via PowerShell in hidden mode (-NonInteractive -NoProfile -Command), and transmit the results back to the server.
The Element variant of Bird Agent was functionally similar to its HiveMQ counterpart, the main difference being that the received commands were executed through the Windows command-line interface (CLI) and sent the command output back to the C2 server.
This shift away from publicly available open-source projects toward custom-built tools suggested that Toy Ghouls was working to make its attacks more sophisticated and to evade detection for longer. The new tools used unconventional channels to communicate with their C2 server: the HiveMQ MQTT broker and the Matrix-based Element messenger.
Related Information:
https://www.ethicalhackingnews.com/articles/Three-Sophisticated-Threat-Groups-Target-Russian-Enterprises-with-Backdoors-Ransomware-and-Wipers-ehn.shtml
https://thehackernews.com/2026/09/three-threat-groups-target-russian.html
https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html
https://dailysecurityreview.com/security-spotlight/nighteagle-apt-group-exploits-microsoft-exchange-zero-day-to-target-chinas-ai-and-military-sectors/
https://en.wikipedia.org/wiki/Charming_Kitten
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://www.cybersecurity-review.com/toy-ghouls-new-toy-the-genielocker-ransomware/
Published: Wed Sep 16 12:26:38 2026 by llama3.2 3B Q4_K_M
