Skip to navigation

Threat reportAPTTL-2026-2606

NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory

criticalACTIVE

NightEagle (APT-Q-95 / APT-C-78), an espionage actor active since at least 2023 against China's defense, semiconductor, AI and quantum-technology sectors, has expanded to Russian enterprises. Using stolen corporate VPN credentials, the group deploys the .NET GhostContainer backdoor on Microsoft Exchange via CVE-2020-0688 exploitation and ASP.NET VIEWSTATE/machineKey theft, then exploits the BlueKeep RDP flaw (CVE-2019-0708) to create rogue local administrator accounts and executes DCSync against Active Directory domain controllers to harvest privileged credentials. First disclosed .

Key facts for NightEagle GhostContainer Exchange

IdentifiersTL-2026-2606, CVE-2019-0708, CVE-2020-0688
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
First disclosed
Exploitation statusExploited in the wild; Listed in CISA KEV: CVE-2019-0708 (added ), CVE-2020-0688 (added )
EPSSCVE-2019-0708: 99.9% (99.9th percentile); CVE-2020-0688: 99.9% (99.9th percentile)
Affected productsMicrosoft Windows / Windows Server Remote Desktop Services; Microsoft Exchange Server
Weaknesses (CWE)CWE-416, CWE-287
AttributionNightEagle (low confidence)
MalwareGhostContainer, Neo-reGeorg - S1189
ToolsChisel, Impacket - S0357, Neo-reGeorg, rdp2tcp, ysoserial (GhostWebShell class)
MITRE ATT&CK techniquesT1003.006 DCSync, T1021.001 Remote Desktop Protocol, T1036.005 Match Legitimate Resource Name or Location, T1053.005 Scheduled Task, T1059.001 PowerShell, T1071.001 Web Protocols, T1078 Valid Accounts, T1090.001 Internal Proxy, T1098.007 Additional Local or Domain Groups, T1133 External Remote Services, T1136.001 Local Account, T1190 Exploit Public-Facing Application and 7 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, defense, military, technology, semi-conductors, artificial intelligence, quantum technology, finance, manufacturing
Target regionschina, russia, Asia
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for NightEagle GhostContainer Exchange

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2606 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GhostContainer CVE-2020-0688 VIEWSTATE Exploitation & App_Web_*.dll Web Shell Drop on Exchange/IIS

Detects exploitation of the Exchange ValidationKey deserialization flaw (CVE-2020-0688) combined with ASP.NET VIEWSTATE parameter manipulation carrying the GhostContainer/ExchangeCmdPy '/wEPDwUKLTcyODc4' prefix against OWA/ECP endpoints, and the subsequent drop of the App_Web_Container_1.dll (or sibling App_Web_*.dll) GhostContainer backdoor assembly into Exchange/IIS web application directories.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1505.003
  • Data sources: iis, exchange_hunt_logs, sysmon, w3c_iis_log, device_file_events
  • Severity: critical
  • Confidence: high

Splunk SPL

index=iis sourcetype="ms:iis:*" (cs_uri_stem="*/owa/*" OR cs_uri_stem="*/ecp/*" OR cs_uri_stem="*/aspnet_client/*")
| eval viewstate=coalesce(cs_cookie, form_data, cs_uri_query)
| eval has_ghostcontainer_prefix=if(match(viewstate, "wEPDwUKLTcyODc4"), 1, 0)
| eval has_owa_postdata_header=if(match(_raw, "(?i)x-owa-urlpostdata"), 1, 0)
| where has_ghostcontainer_prefix=1 OR has_owa_postdata_header=1
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri_stem) as targeted_paths dc(c_ip) as distinct_src_ips values(c_ip) as source_ips values(sc_status) as status_codes by cs_host
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*\\inetpub\\*\\bin\\App_Web_*.dll" OR TargetFilename="*\\Exchange*\\ClientAccess\\*\\App_Web_*.dll")
    | stats count min(_time) as first_seen values(TargetFilename) as dropped_dll values(Image) as writing_process values(Hashes) as file_hashes by host user ]
| table first_seen last_seen cs_host source_ips targeted_paths dropped_dll writing_process file_hashes count

Microsoft KQL

let ghostcontainer_prefix = "wEPDwUKLTcyODc4";
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has_any ("/owa", "/ecp", "/aspnet_client")
| where csCookie has ghostcontainer_prefix or csUriQuery has ghostcontainer_prefix or RequestHeaders has "x-owa-urlpostdata"
| project TimeGenerated, csHost, csUriStem, cIP, scStatus, RequestHeaders
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FolderPath has_any ("inetpub", "ClientAccess") and FileName startswith "App_Web_" and FileName endswith ".dll"
    | project DropTime = TimeGenerated, DeviceName, FileName, InitiatingProcessFileName, SHA256
) on $left.csHost == $right.DeviceName
| summarize RequestCount = count(), TargetPaths = make_set(csUriStem), SourceIPs = make_set(cIP), DroppedFiles = make_set(FileName) by csHost

Sigma

title: GhostContainer App_Web Backdoor DLL Dropped in Exchange/IIS Directory
id: 7a1e3d4c-6b2f-4a89-9c3e-1f0a8b5d2e6c
status: experimental
description: Detects creation of an App_Web_*.dll assembly inside Exchange/IIS ClientAccess or inetpub bin directories, consistent with the NightEagle GhostContainer backdoor deployed via CVE-2020-0688 exploitation and VIEWSTATE machineKey abuse.
references:
    - https://securelist.com/ghostcontainer/116953/
    - https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.initial-access
    - attack.persistence
    - attack.t1190
    - attack.t1505.003
    - cve.2020.0688
    - attack.group.nighteagle
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\inetpub\'
            - '\ClientAccess\'
    selection_name:
        TargetFilename|startswith: 'App_Web_'
        TargetFilename|endswith: '.dll'
    condition: selection_path and selection_name
falsepositives:
    - Legitimate ASP.NET temporary compilation assemblies generated during Exchange Cumulative Update installation (these are typically GUID-named, not App_Web_Container_1.dll variants and correlate with a patch-management change window)
level: critical

Known false positives:

  • Legitimate ASP.NET temp-compilation assemblies dropped during a scheduled Exchange Cumulative Update install window
  • Internal vulnerability-scanning/pentest traffic replaying the public CVE-2020-0688 PoC against a lab Exchange instance

Tuning notes: Correlate the App_Web_*.dll drop with the preceding VIEWSTATE/POST hit within a 5-minute window to cut noise from legitimate CU-driven recompiles; exclude known-good CU maintenance windows via a change-calendar lookup, and pivot dropped-file hashes against the known IOC set (01d98380dfb9211251c75c87ddb3c79c, 3ecd1cd627d0340c92901a478a7caad8, 631fb131a56caf4ca0f287ed73e876ab).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Successful VPN Authentication from Cloudflare WARP / Anomalous European VPS Infrastructure Preceding Exchange Access · unlock with TL Creds
  • BlueKeep-Triggered Local Administrator Account Creation and Remote Desktop Group Membership Change on Legacy RDP Hosts · unlock with TL Creds
  • rdp2tcp RDP Virtual-Channel Tunneling with netsh Port-Proxy Redirection and Impacket atexec Remote Execution · unlock with TL Creds
  • GhostContainer Stub AES-Encrypted Command Delivery via x-owa-urlpostdata Header · unlock with TL Creds
  • NightEagle Masquerading Toolset Execution ([indicator] / trueconf*.exe / [indicator] / [indicator]) · unlock with TL Creds
  • Microsoft Dev Tunnels (*.[indicator]) Abused to Expose Internal RDP as Covert C2 Infrastructure · unlock with TL Creds
  • GhostContainer Defense Evasion — AMSI (amsi.dll) and ntdll.dll In-Memory Patching to Disable Scanning and Event Logging · unlock with TL Creds
  • Active Directory DCSync Directory-Replication Abuse with Correlated Anomalous Kerberos Ticket Flags · unlock with TL Creds

Indicators of compromise for NightEagle GhostContainer Exchange

As of 2026-09-21, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2606.

Sample indicators (3 of 24)

  • Domain: devtunnels[.]ms
  • File hash: 1f3034b706c78b35d8e34044e68c693a
  • File hash: 3ecd1cd627d0340c92901a478a7caad8

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

24 indicators of compromise · unlock with TL Creds. Compare plans

How NightEagle GhostContainer Exchange works

NightEagle, tracked by Chinese vendors QiAnXin (as APT-Q-95) and Qihoo 360 (as APT-C-78), was first publicly disclosed in July 2025 after incident responders discovered a customized Chisel-based (Go) tunneling implant running as a scheduled task on a customer endpoint, configured to establish SOCKS connections to attacker C2 every four hours. That investigation uncovered a campaign against Chinese government, military, semiconductor, artificial-intelligence and quantum-technology organizations using a bespoke .NET loader implanted into IIS on Microsoft Exchange servers via theft of the ASP.NET machineKey and deserialization abuse — initially suspected to be a zero-day, later assessed by Kaspersky as exploitation of the known CVE-2020-0688 Exchange memory-corruption vulnerability combined with VIEWSTATE parameter manipulation. Analysis of the group's operational tempo (attacks concentrated 9 p.m.-6 a.m. Beijing time) led Chinese researchers to assess a possible North American origin, an attribution that remains disputed and unconfirmed by independent analysts.

Starting roughly one year before September 2026, Kaspersky's Global Emergency Response Team observed NightEagle expanding operations to Russian businesses. Initial access in the Russian intrusions relies on compromised legitimate corporate VPN credentials, with connections traced to Russian-segment IP addresses linked to Cloudflare WARP tunnels and to European VPS providers. Once inside, the group deploys the GhostContainer backdoor (disguised as App_Web_Container_1.dll and related App_Web_* assemblies) on Exchange servers. GhostContainer is a modular .NET implant built from open-source components: a Neo-reGeorg-derived proxy/tunnel module (HTTP proxying and TCP socket forwarding via custom headers), ysoserial's GhostWebShell class, and CVE-2020-0688 exploit code drawn from the public ExchangeCmdPy.py framework. Its Stub component receives AES-encrypted, compressed commands through the x-owa-urlpostdata HTTP header, decrypts them using a key derived from the stolen ASP.NET machine validation key, and returns base64-encoded results embedded in a VIEWSTATE parameter carrying the same '/wEPDwUKLTcyODc4' prefix observed in the CVE-2020-0688 exploitation toolchain. To blend into legitimate traffic and impede detection and response, the Stub patches amsi.dll to bypass the Antimalware Scan Interface and patches ntdll.dll to disable Windows Event Logging.

For lateral movement, NightEagle exploits the BlueKeep RDP vulnerability (CVE-2019-0708) — a critical, pre-authentication use-after-free in Remote Desktop Services affecting Windows 7 SP1 and Windows Server 2008/2008 R2 — to create a local account and add it to the local Administrators and Remote Desktop Users groups on targeted hosts. To move RDP traffic covertly, the group combines the legitimate Microsoft Dev Tunnels service (exposing port 3389 via attacker-controlled *.devtunnels.ms subdomains) with the public rdp2tcp utility, which tunnels TCP traffic over an established RDP virtual channel (visible in Windows Event IDs 132/148 as a channel named 'rdp2tcp'), and with netsh interface portproxy rules to redirect traffic between ports (e.g., 443 to internal SMB). The group also uses the Impacket toolkit's atexec module to run commands via the Windows Task Scheduler RPC interface on remote hosts. With a persistent foothold, NightEagle conducts DCSync attacks — issuing directory-replication requests that impersonate a domain controller to replicate the AD Domain-Password object and harvest password hashes for privileged accounts — and requests Kerberos service tickets carrying an unusual combination of Forwardable, Proxiable, and Renewable flags, consistent with ticket-relay/delegation-abuse activity rather than routine authentication. Malicious executables are masqueraded with names mimicking legitimate software (AdobeSync.exe, adobe_32.exe, trueconf.exe, trueconf-broker.exe, 1cbroker.exe, 1c-office-plugin.exe) and staged via GitHub repositories disguised as unrelated open-source projects.

Kaspersky assesses the group updated its persistence and lateral-movement tradecraft specifically to support the geographic expansion into Russia, indicating continued investment in the toolset rather than a one-off campaign.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 DCSync; T1558 Steal or Forge Kerberos Tickets

Lateral Movement

T1021.001 Remote Desktop Protocol

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading

Execution

T1053.005 Scheduled Task; T1059.001 PowerShell

Command and Control

T1071.001 Web Protocols; T1090.001 Internal Proxy; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Privilege Escalation

T1098.007 Additional Local or Domain Groups

Persistence

T1136.001 Local Account; T1505.003 Web Shell

command-and-control

T1573.001 Symmetric Cryptography

defense-impairment

T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log

Remediation for NightEagle GhostContainer Exchange

Patches

  • Microsoft Security Bulletin MS19-013 / KB4499175 (CVE-2019-0708)
  • Exchange Server security update addressing CVE-2020-0688 (see ZDI-20-258)

Immediate actions

  • Patch CVE-2019-0708 (BlueKeep) on every Windows Server 2008/2008 R2/Windows 7 SP1 host still exposing RDP (MS19-013 / KB4499175)
  • Apply current Exchange Cumulative and Security Updates to remediate CVE-2020-0688 and rotate the ASP.NET machineKey/validation key on all Exchange servers
  • Force a password reset and enforce MFA on all corporate VPN accounts; review VPN logs for logins from Cloudflare WARP or unfamiliar European VPS ranges
  • Hunt for and remove unauthorized App_Web_*.dll assemblies (e.g., App_Web_Container_1.dll) on Exchange/IIS servers
  • Audit for local accounts unexpectedly added to the Administrators or Remote Desktop Users groups

Workarounds

  • Disable RDP or enforce Network Level Authentication on legacy Windows Server 2008/2008 R2/7 hosts pending patching
  • Block outbound access to *.devtunnels.ms and known GitHub tool-staging repositories at the perimeter where Dev Tunnels is not a business requirement

Longer-term hardening

  • Deploy EDR coverage for reflective .NET assembly loading and AMSI-patching behavior
  • Restrict and alert on accounts holding Replicating Directory Changes / Replicating Directory Changes All permissions to a minimal, monitored set (DCSync abuse surface)
  • Alert on DNS resolution of *.devtunnels.ms from servers and on RDP virtual-channel names matching 'rdp2tcp' (Event IDs 132/148)
  • Segment Exchange servers from direct RDP/SMB reachability to domain controllers
  • Monitor for Kerberos ticket requests with atypical Forwardable+Proxiable+Renewable flag combinations

Affected and fixed versions

  • Microsoft — Windows / Windows Server Remote Desktop Services
    Vulnerable versions: Windows 7 SP1 (32-bit and x64); Windows Server 2008 SP2 (32-bit and x64); Windows Server 2008 R2 SP1 (x64 and Itanium)
    Fixed in: Patched per MS19-013 / KB4499175
  • Microsoft — Exchange Server
    Vulnerable versions: Exchange Server 2010 SP3 prior to Update Rollup 30; Exchange Server 2013 prior to Cumulative Update 23; Exchange Server 2016 prior to Cumulative Update 14/15; Exchange Server 2019 prior to Cumulative Update 3/4
    Fixed in: Current Exchange Cumulative/Security Updates addressing CVE-2020-0688

Timeline of NightEagle GhostContainer Exchange

  • Microsoft discloses and patches CVE-2019-0708 (BlueKeep) via MS19-013/KB4499175, the vulnerability NightEagle later exploits for lateral movement.
  • Microsoft patches CVE-2020-0688, the Exchange Server memory-corruption/authentication flaw later incorporated into the locked-ioc-16 deployment chain.
  • CISA adds both CVE-2019-0708 (BlueKeep) and CVE-2020-0688 to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation.
  • NightEagle (APT-Q-95/APT-C-78) begins operations, active since at least this point against Chinese defense, semiconductor, AI and quantum-technology organizations.
  • Incident responders discover a customized Chisel-based (Go) tunneling implant running as a scheduled task on a customer endpoint, opening the investigation that identifies NightEagle.
  • QiAnXin (as APT-Q-95) and Qihoo 360 (as APT-C-78) publicly disclose NightEagle's campaign against China's military, semiconductor, AI and quantum-tech sectors; Kaspersky separately publishes its locked-ioc-16 Exchange-backdoor technical analysis on Securelist.
  • Kaspersky's Global Emergency Response Team dates the start of NightEagle's expansion beyond Asia to target Russian enterprises to approximately this period.
  • Kaspersky GERT publishes follow-up Securelist research detailing NightEagle's BlueKeep exploitation, DCSync attacks, Kerberos ticket abuse, and locked-ioc-11/locked-ioc-23 tunneling against Russian Active Directory environments.
  • GBHackers publishes a detailed attack-chain writeup summarizing the VPN-credential-to-GhostContainer-to-BlueKeep-to-DCSync intrusion chain.

Sources cited for NightEagle GhostContainer Exchange

More from NightEagle

Other reports on CVE-2019-0708

Other reports on CVE-2020-0688

Previous and next in apt

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats