NightEagle APT Targets Russian Organizations with GhostContainer Backdoor

The NightEagle APT group (also known as APT-Q-95) has expanded its targeting to include organizations in Russia. Active since 2023, the group employs a sophisticated multi-stage approach, initiating access via compromised VPN credentials. A primary focus of their campaign is the deployment of the GhostContainer backdoor on Microsoft Exchange servers. This backdoor is highly evasive, functioning in-memory by patching amsi.dll and ntdll.dll to circumvent security monitoring. The attackers utilize custom C2 communication headers and frequently abuse legitimate utilities, such as Microsoft Dev Tunnels, to facilitate RDP-based lateral movement. Tools are sourced from GitHub repositories disguised to mimic legitimate software, while the payload delivery often involves sophisticated manipulation of ASP.NET VIEWSTATE parameters. The group’s reliance on dual-use infrastructure and legitimate tunneling services poses significant challenges for traditional perimeter-based defenses.

Attack Chain

1. Initial access is gained by using compromised valid credentials to authenticate against corporate VPN services.
2. Attackers extract cryptographic keys from the ASP.NET configuration on Microsoft Exchange servers.
3. The VIEWSTATE framework parameter is overwritten to inject a payload, facilitating the in-memory execution of the GhostContainer backdoor.
4. The backdoor establishes persistence in-memory and patches amsi.dll and ntdll.dll to bypass AMSI and Windows Event Log monitoring.
5. Command-and-control communication is established by parsing specific headers (x-owa-urlpostdata) on the infected Exchange host.
6. Attackers download malicious toolsets from GitHub repositories, disguised as legitimate software archives (e.g., Adobe or 1C broker software).
7. Microsoft Dev Tunnels are configured on the compromised system to expose RDP (port 3389) to the internet.
8. Attackers perform lateral movement throughout the internal network using the established RDP tunnel.

Impact

The campaign results in persistent unauthorized access to internal network segments and sensitive Microsoft Exchange environments. By gaining RDP-level access to internal workstations and servers, NightEagle can facilitate data exfiltration, credential harvesting, and long-term surveillance within targeted Russian businesses.

Recommendation

Prioritize the identification of abnormal RDP tunneling and suspicious memory-injected payloads on Exchange infrastructure.

• Patch CVE-2020-0688 on all Microsoft Exchange servers immediately.
• Hunt for the execution of unauthorized binaries masquerading as legitimate software (e.g., AdobeSync.exe, 1cbroker.exe) originating from unauthorized paths.
• Monitor for the creation of Microsoft Dev Tunnels sessions, specifically connections to *.devtunnels.ms.
• Restrict and audit the use of VPN credentials, implementing phishing-resistant MFA for all remote access.
• Baseline and monitor ASP.NET configuration changes on web servers to detect potential tampering with VIEWSTATE parameters.