Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Summary: Kaspersky reports three threat clusters - NightEagle, Hacking Cat, and Toy Ghouls - targeting Russian enterprises, with NightEagle using compromised valid credentials to reach corporate VPNs and deploying the GhostContainer backdoor on Microsoft Exchange servers. Hacking Cat has shifted from defacements to encryption and destructive attacks using Gorilla RAT, Monkey ransomware variants, ClearWater, and Nemo Wiper, while Toy Ghouls delivers Bird Agent backdoors over WinRM that communicate through HiveMQ MQTT and Matrix-based Element channels.
Key Takeaway: NightEagle's path in was valid credentials over VPN, and its end goal was domain controller access and the victim's entire Active Directory - the identity layer most organizations treat as trusted by default. Toy Ghouls hides command-and-control inside MQTT and Matrix traffic, which defeats detection rules built to flag non-standard protocols.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2019-0708 CVE-2020-0688 CVE-2021-26855 CVE-2026-42897
Related: Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia Cyber Risks ·
CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · May 15, 2026
CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021