NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on (TL-2026-2606) is a critical-severity advanced persistent threat campaign scored CVSS 9.8, first published 2026-09-21. It is attributed to NightEagle with low confidence, affects Microsoft Windows / Windows Server Remote Desktop Services, references 2 CVEs (CVE-2019-0708, CVE-2020-0688), maps to 19 MITRE ATT&CK techniques (T1003.006, T1021.001, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2606
- Threat ID
- TL-2026-2606
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-09-21
- Last reviewed
- 2026-09-21
- Attribution
- NightEagle
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, military, technology, semi-conductors, artificial intelligence, quantum technology, finance, manufacturing
- Target regions
- china, russia, Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
Malware and tooling: GhostContainer, Neo-reGeorg - S1189, Chisel, Impacket - S0357, Neo-reGeorg, rdp2tcp, ysoserial (GhostWebShell class)
NightEagle (APT-Q-95 / APT-C-78), an espionage actor active since at least 2023 against China's defense, semiconductor, AI and quantum-technology sectors, has expanded to Russian enterprises. Using stolen corporate VPN credentials, the group deploys the .NET GhostContainer backdoor on Microsoft Exchange via CVE-2020-0688 exploitation and ASP.NET VIEWSTATE/machineKey theft, then exploits the BlueKeep RDP flaw (CVE-2019-0708) to create rogue local administrator accounts and executes DCSync against Active Directory domain controllers to harvest privileged credentials.
How NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on works
NightEagle, tracked by Chinese vendors QiAnXin (as APT-Q-95) and Qihoo 360 (as APT-C-78), was first publicly disclosed in July 2025 after incident responders discovered a customized Chisel-based (Go) tunneling implant running as a scheduled task on a customer endpoint, configured to establish SOCKS connections to attacker C2 every four hours. That investigation uncovered a campaign against Chinese government, military, semiconductor, artificial-intelligence and quantum-technology organizations using a bespoke .NET loader implanted into IIS on Microsoft Exchange servers via theft of the ASP.NET machineKey and deserialization abuse — initially suspected to be a zero-day, later assessed by Kaspersky as exploitation of the known CVE-2020-0688 Exchange memory-corruption vulnerability combined with VIEWSTATE parameter manipulation. Analysis of the group's operational tempo (attacks concentrated 9 p.m.-6 a.m. Beijing time) led Chinese researchers to assess a possible North American origin, an attribution that remains disputed and unconfirmed by independent analysts.
Starting roughly one year before September 2026, Kaspersky's Global Emergency Response Team observed NightEagle expanding operations to Russian businesses. Initial access in the Russian intrusions relies on compromised legitimate corporate VPN credentials, with connections traced to Russian-segment IP addresses linked to Cloudflare WARP tunnels and to European VPS providers. Once inside, the group deploys the GhostContainer backdoor (disguised as App_Web_Container_1.dll and related App_Web_* assemblies) on Exchange servers. GhostContainer is a modular .NET implant built from open-source components: a Neo-reGeorg-derived proxy/tunnel module (HTTP proxying and TCP socket forwarding via custom headers), ysoserial's GhostWebShell class, and CVE-2020-0688 exploit code drawn from the public ExchangeCmdPy.py framework. Its Stub component receives AES-encrypted, compressed commands through the x-owa-urlpostdata HTTP header, decrypts them using a key derived from the stolen ASP.NET machine validation key, and returns base64-encoded results embedded in a VIEWSTATE parameter carrying the same '/wEPDwUKLTcyODc4' prefix observed in the CVE-2020-0688 exploitation toolchain. To blend into legitimate traffic and impede detection and response, the Stub patches amsi.dll to bypass the Antimalware Scan Interface and patches ntdll.dll to disable Windows Event Logging.
For lateral movement, NightEagle exploits the BlueKeep RDP vulnerability (CVE-2019-0708) — a critical, pre-authentication use-after-free in Remote Desktop Services affecting Windows 7 SP1 and Windows Server 2008/2008 R2 — to create a local account and add it to the local Administrators and Remote Desktop Users groups on targeted hosts. To move RDP traffic covertly, the group combines the legitimate Microsoft Dev Tunnels service (exposing port 3389 via attacker-controlled *.devtunnels.ms subdomains) with the public rdp2tcp utility, which tunnels TCP traffic over an established RDP virtual channel (visible in Windows Event IDs 132/148 as a channel named 'rdp2tcp'), and with netsh interface portproxy rules to redirect traffic between ports (e.g., 443 to internal SMB). The group also uses the Impacket toolkit's atexec module to run commands via the Windows Task Scheduler RPC interface on remote hosts. With a persistent foothold, NightEagle conducts DCSync attacks — issuing directory-replication requests that impersonate a domain controller to replicate the AD Domain-Password object and harvest password hashes for privileged accounts — and requests Kerberos service tickets carrying an unusual combination of Forwardable, Proxiable, and Renewable flags, consistent with ticket-relay/delegation-abuse activity rather than routine authentication. Malicious executables are masqueraded with names mimicking legitimate software (AdobeSync.exe, adobe_32.exe, trueconf.exe, trueconf-broker.exe, 1cbroker.exe, 1c-office-plugin.exe) and staged via GitHub repositories disguised as unrelated open-source projects.
Kaspersky assesses the group updated its persistence and lateral-movement tradecraft specifically to support the geographic expansion into Russia, indicating continued investment in the toolset rather than a one-off campaign.
MITRE ATT&CK techniques used in TL-2026-2606
Credential Access
T1003.006 DCSync; T1558 Steal or Forge Kerberos Tickets
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading
Execution
T1053.005 Scheduled Task; T1059.001 PowerShell
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Privilege Escalation
T1098.007 Additional Local or Domain Groups
Persistence
T1136.001 Local Account; T1505.003 Web Shell
command-and-control
T1573.001 Symmetric Cryptography
defense-impairment
T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log
Affected products and versions in NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
- Microsoft — Windows / Windows Server Remote Desktop Services
Vulnerable versions: Windows 7 SP1 (32-bit and x64); Windows Server 2008 SP2 (32-bit and x64); Windows Server 2008 R2 SP1 (x64 and Itanium)
Fixed in: Patched per MS19-013 / KB4499175 - Microsoft — Exchange Server
Vulnerable versions: Exchange Server 2010 SP3 prior to Update Rollup 30; Exchange Server 2013 prior to Cumulative Update 23; Exchange Server 2016 prior to Cumulative Update 14/15; Exchange Server 2019 prior to Cumulative Update 3/4
Fixed in: Current Exchange Cumulative/Security Updates addressing CVE-2020-0688
Remediation for NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
Patches
- Microsoft Security Bulletin MS19-013 / KB4499175 (CVE-2019-0708)
- Exchange Server security update addressing CVE-2020-0688 (see ZDI-20-258)
Immediate actions
- Patch CVE-2019-0708 (BlueKeep) on every Windows Server 2008/2008 R2/Windows 7 SP1 host still exposing RDP (MS19-013 / KB4499175)
- Apply current Exchange Cumulative and Security Updates to remediate CVE-2020-0688 and rotate the ASP.NET machineKey/validation key on all Exchange servers
- Force a password reset and enforce MFA on all corporate VPN accounts; review VPN logs for logins from Cloudflare WARP or unfamiliar European VPS ranges
- Hunt for and remove unauthorized App_Web_*.dll assemblies (e.g., App_Web_Container_1.dll) on Exchange/IIS servers
- Audit for local accounts unexpectedly added to the Administrators or Remote Desktop Users groups
Workarounds
- Disable RDP or enforce Network Level Authentication on legacy Windows Server 2008/2008 R2/7 hosts pending patching
- Block outbound access to *.devtunnels.ms and known GitHub tool-staging repositories at the perimeter where Dev Tunnels is not a business requirement
Longer-term hardening
- Deploy EDR coverage for reflective .NET assembly loading and AMSI-patching behavior
- Restrict and alert on accounts holding Replicating Directory Changes / Replicating Directory Changes All permissions to a minimal, monitored set (DCSync abuse surface)
- Alert on DNS resolution of *.devtunnels.ms from servers and on RDP virtual-channel names matching 'rdp2tcp' (Event IDs 132/148)
- Segment Exchange servers from direct RDP/SMB reachability to domain controllers
- Monitor for Kerberos ticket requests with atypical Forwardable+Proxiable+Renewable flag combinations
CVEs associated with NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
CVE-2019-0708, CVE-2020-0688
Weaknesses (CWE) in NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
CWE-416, CWE-287
Timeline of NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
- Microsoft discloses and patches CVE-2019-0708 (BlueKeep) via MS19-013/KB4499175, the vulnerability NightEagle later exploits for lateral movement.
- Microsoft patches CVE-2020-0688, the Exchange Server memory-corruption/authentication flaw later incorporated into the GhostContainer deployment chain.
- CISA adds both CVE-2019-0708 (BlueKeep) and CVE-2020-0688 to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation.
- NightEagle (APT-Q-95/APT-C-78) begins operations, active since at least this point against Chinese defense, semiconductor, AI and quantum-technology organizations.
- Incident responders discover a customized Chisel-based (Go) tunneling implant running as a scheduled task on a customer endpoint, opening the investigation that identifies NightEagle.
- QiAnXin (as APT-Q-95) and Qihoo 360 (as APT-C-78) publicly disclose NightEagle's campaign against China's military, semiconductor, AI and quantum-tech sectors; Kaspersky separately publishes its GhostContainer Exchange-backdoor technical analysis on Securelist.
- Kaspersky's Global Emergency Response Team dates the start of NightEagle's expansion beyond Asia to target Russian enterprises to approximately this period.
- Kaspersky GERT publishes follow-up Securelist research detailing NightEagle's BlueKeep exploitation, DCSync attacks, Kerberos ticket abuse, and Microsoft Dev Tunnels/rdp2tcp tunneling against Russian Active Directory environments.
- GBHackers publishes a detailed attack-chain writeup summarizing the VPN-credential-to-GhostContainer-to-BlueKeep-to-DCSync intrusion chain.
Sources cited for NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on
- NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
- NightEagle APT targets Russian organizations (GhostContainer and tunneling)
- GhostContainer backdoor for Exchange servers
- GhostContainer discovered: Kaspersky identifies a new backdoor targeting Microsoft Exchange servers
- NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors
- Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
- Hacking group 'NightEagle' targeting China's high-tech sector expands operations to Russia
- CVE-2019-0708 (BlueKeep) - NVD
- CVE-2020-0688 - NVD
- ZDI-20-258: Microsoft Exchange Server ValidationKey Remote Code Execution Vulnerability
- CISA Known Exploited Vulnerabilities Catalog - CVE-2019-0708
- CISA Known Exploited Vulnerabilities Catalog - CVE-2020-0688
- rdp2tcp - RDP virtual-channel tunneling tool
More in apt
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
Detection coverage for TL-2026-2606
As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2606 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.