NightEagle, Hacking Cat, and Toy Ghouls Target Russian Networks

Russian enterprises are facing three distinct intrusion clusters combining stolen VPN credentials, Microsoft Exchange exploitation, Active Directory attacks, ransomware, and destructive malware.

Kaspersky associates the activity with NightEagle, also tracked as APT-Q-95; the pro-Ukrainian hacktivist group Hacking Cat; and the financially motivated Toy Ghouls, known as Bearlyfy, Laboo.boo, and Feral Wolf.

Although their motivations and tooling differ, all three groups seek durable access to corporate infrastructure. The campaigns affect Windows, Linux, and VMware ESXi systems and mix custom malware with open-source offensive utilities.

Four exploited or targeted vulnerabilities appear in the reporting: CVE-2019-0708, CVE-2020-0688, CVE-2021-26855, and CVE-2026-42897. All four are in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

NightEagle Pursues Control of Active Directory

NightEagle has operated since at least 2023 and typically enters corporate networks through valid credentials used against VPN services. Observed connections originated from Russian IP space associated with Cloudflare WARP tunnels and from European virtual infrastructure providers.

Once inside, the group concentrates on persistence, lateral movement, credential acquisition, and eventual control of Active Directory.

A central component is GhostContainer, a modular backdoor designed to provide extensive access to Microsoft Exchange Server. It supports arbitrary code execution, file manipulation, additional module loading, traffic redirection, and tunneling. The malware also disguises itself as an ordinary server component to reduce its visibility.

Parts of GhostContainer derive from public projects, including Neo-reGeorg, GhostWebShell code from ysoserial, and an exploit for CVE-2020-0688. That vulnerability affects Microsoft Exchange Server 2010 and carries a CVSS score of 8.8.

The exact Exchange delivery path is not known. One assessed possibility involves stealing cryptographic keys from the ASP.NET configuration, modifying the ASP.NET VIEWSTATE value, and inserting a payload that executes the backdoor in memory.

NightEagle then uses tunneling utilities such as Microsoft dev tunnels and rdp2tcp to route Remote Desktop Protocol traffic into internal systems. Previously established tunnels give operators access to infrastructure that is not directly exposed to the internet.

In one intrusion, the group exploited BlueKeep, CVE-2019-0708, to create a local account and place it in the Administrators and Remote Desktop Users groups. It also attempted a DCSync attack, impersonating a domain controller to retrieve domain credential material.

The broader objective is clear: obtain password hashes, create long-lived Kerberos access, compromise domain controllers, and gain lasting control over the victim’s identity infrastructure.

Hacking Cat Combines Remote Access With Destructive Malware

Hacking Cat has conducted defacements and data breaches since February 2024, but its operations have shifted toward encryption and system destruction. The group collaborates with Cyber Anarchy Squad and the Ukrainian Cyber Alliance, complicating attribution because multiple crews can deploy the same malware.

Kaspersky says the group exploited Exchange vulnerabilities CVE-2021-26855 and CVE-2026-42897 to install Gorilla RAT, a Go-based remote access trojan. Precise details connecting each flaw to the final payload execution stage have not been disclosed.

Gorilla RAT registers infected machines with a remote server and waits for instructions. Operators can execute commands, enumerate processes, collect host information, transfer files, and open or close TCP tunnels. That tunneling capability turns a compromised Exchange server into an entry point for deeper network access.

Hacking Cat has also deployed Monkey ransomware variants written in Rust, .NET, C++, and Go. The family targets Windows, Linux, and VMware ESXi, with the earliest reported artifact dating to late summer 2025.

The Rust edition creates a 32-byte key and uses ChaCha20-Poly1305. Some builds never preserve the key, making recovery impossible even when a ransom note appears. Those samples function as wipers rather than conventional ransomware.

The .NET build uses AES-256-CBC and sends its key to command-and-control infrastructure. It can escalate privileges, disable Windows recovery, steal Outlook credentials, delete backup-related files, and remove itself.

The C++ edition adds scheduled-task or RunOnce persistence, log deletion, PowerShell and Command Prompt history removal, and interference with AMSI and Event Tracing for Windows. It also creates Microsoft Defender exclusions and disrupts VSS, backup, database, and recovery services.

The Go variant primarily targets Linux and ESXi. It uses crontab for persistence and attempts to disable SELinux and AppArmor. Its retained Windows shadow-copy removal logic has little relevance on those platforms, which Kaspersky views as possible evidence of careless or AI-assisted development.

Hacking Cat has additionally participated in ClearWater ransomware deployments and Nemo Wiper operations. Nemo overwrites files with random bytes, then consumes remaining disk space with randomly named .lock files.

The group disputed parts of the attribution after the findings appeared. It acknowledged ownership of some tools but denied owning the ransomware lockers and claimed that unrelated actors’ malware had been incorrectly grouped with its operations. That dispute remains unresolved.

Toy Ghouls Hides Commands in MQTT and Matrix Traffic

Toy Ghouls has been active since 2025 and is primarily financially motivated. After using leaked Babuk and LockBit builders and later its own GenieLocker ransomware, the group introduced a custom backdoor called Bird Agent.

The malware was first detected in July 2026. Two version 0.1.0 variants are known:

• mqtt-bird-agent 0.1.0, using a HiveMQ MQTT broker;
• matrix-bird-agent 0.1.0, using the Matrix-based Element messaging platform.

Toy Ghouls delivers the backdoor and its configuration through Windows Remote Management, supported by open-source tools including Evil-WinRM and WinRM-fs. Bird Agent provides an interactive command session and can install itself as a Windows service.

At launch, it searches its directory for config.toml, although operators can specify another path with -c or --config. The malware partially encrypts that configuration using a key derived from the host’s Registry MachineGuid, binding the file to one machine. Later executions terminate if decryption fails.

The MQTT configuration contains a HiveMQ cluster identifier. The Element edition instead stores a room identifier and access token, prompting for the token during installation if the field is empty.

After sending system details to the operator, the HiveMQ variant retrieves commands through HTTP GET requests and runs them in hidden PowerShell sessions with:

-NonInteractive -NoProfile -Command

The Element build performs comparable operations through the Windows command-line interface. Both return command output through their respective C2 channels.

MQTT brokers and encrypted Matrix rooms can be harder to distinguish from legitimate application traffic than conventional command-and-control servers. Defenders must therefore inspect context and endpoint behavior, not merely block unfamiliar domains.

Four KEV Vulnerabilities Define the Immediate Patch Scope

All four cited vulnerabilities have confirmed exploitation status through CISA’s KEV catalog:

Vulnerability	Affected products in the available records	Score	KEV added	Federal deadline
CVE-2019-0708	Windows 7, Windows Server 2008, and listed Siemens Axiom, Mobilett, and Multix products; versions are not specified	9.8	November 3, 2021	May 3, 2022
CVE-2020-0688	Microsoft Exchange Server 2010	8.8	November 3, 2021	May 3, 2022
CVE-2021-26855	Exchange Server 2013 CU21–CU23 and Exchange Server 2016 CU10–CU16	9.8 NIST; 9.1 Microsoft CNA	November 3, 2021	May 3, 2022
CVE-2026-42897	Exchange Server 2016 and Exchange Server Subscription Edition below 15.02.2562.043	8.1	May 15, 2026	May 29, 2026

CVE-2021-26855 is an SSRF vulnerability. NIST rates it 9.8, reflecting high confidentiality, integrity, and availability impacts, while Microsoft’s CNA score is 9.1 and records no availability impact.

CVE-2026-42897 is a cross-site scripting flaw that enables network-based spoofing and requires user interaction. CISA directs organizations to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue the product when mitigations are unavailable. The other three entries require vendor updates. CVE-2019-0708, CVE-2020-0688, and CVE-2021-26855 are recorded as used in ransomware campaigns.

The broader Microsoft and Siemens KEV exposure is continuing. During the last 90 days, CVE-2025-25249 entered the catalog on September 9, 2026; CVE-2026-81963 and CVE-2026-85880 on September 8, 2026; CVE-2019-1068 on August 26, 2026; and CVE-2026-33824 and CVE-2026-55040 on August 18, 2026.

What Defenders Should Hunt for Now

Organizations should first patch or mitigate every affected Exchange, Windows, and Siemens deployment. Internet-facing Exchange servers and systems reachable through VPN, RDP, or WinRM deserve priority.

Security teams should then investigate:

• successful VPN authentication from unexpected Cloudflare WARP or European hosting addresses;
• suspicious ASP.NET configuration access, VIEWSTATE manipulation, and in-memory Exchange payloads;
• unauthorized local accounts or additions to Administrators and Remote Desktop Users;
• DCSync behavior, abnormal Kerberos ticket lifetimes, and unusual domain-controller access;
• Microsoft dev tunnels, rdp2tcp, Evil-WinRM, and WinRM-fs activity;
• new services, scheduled tasks, RunOnce entries, or crontab persistence;
• config.toml beside unknown executables and connections involving HiveMQ or Matrix/Element;
• VSS disruption, disabled backups, Defender exclusions, AMSI or ETW tampering, and cleared shell history;
• random .lock files consuming free space.

Incident-response plans must assume destructive impact. A Monkey infection may discard its key entirely, while Nemo deliberately overwrites data, leaving restoration from protected offline backups as the only practical recovery path.