# NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory

> NightEagle (APT-Q-95 / APT-C-78), an espionage actor active since at least 2023 against China's defense, semiconductor, AI and quantum-technology sectors, has expanded to Russian enterprises. Using stolen corporate VPN credentials, the group deploys the .NET GhostContainer backdoor on Microsoft Exchange via CVE-2020-0688 exploitation and ASP.NET VIEWSTATE/machineKey theft, then exploits the BlueKeep RDP flaw (CVE-2019-0708) to create rogue local administrator accounts and executes DCSync against Active Directory domain controllers to harvest privileged credentials.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2606
- **ID:** TL-2026-2606
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** NightEagle
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-0708, CVE-2020-0688

## Description

NightEagle, tracked by Chinese vendors QiAnXin (as APT-Q-95) and Qihoo 360 (as APT-C-78), was first publicly disclosed in July 2025 after incident responders discovered a customized Chisel-based (Go) tunneling implant running as a scheduled task on a customer endpoint, configured to establish SOCKS connections to attacker C2 every four hours. That investigation uncovered a campaign against Chinese government, military, semiconductor, artificial-intelligence and quantum-technology organizations using a bespoke .NET loader implanted into IIS on Microsoft Exchange servers via theft of the ASP.NET machineKey and deserialization abuse — initially suspected to be a zero-day, later assessed by Kaspersky as exploitation of the known CVE-2020-0688 Exchange memory-corruption vulnerability combined with VIEWSTATE parameter manipulation. Analysis of the group's operational tempo (attacks concentrated 9 p.m.-6 a.m. Beijing time) led Chinese researchers to assess a possible North American origin, an attribution that remains disputed and unconfirmed by independent analysts.

Starting roughly one year before September 2026, Kaspersky's Global Emergency Response Team observed NightEagle expanding operations to Russian businesses. Initial access in the Russian intrusions relies on compromised legitimate corporate VPN credentials, with connections traced to Russian-segment IP addresses linked to Cloudflare WARP tunnels and to European VPS providers. Once inside, the group deploys the GhostContainer backdoor (disguised as App_Web_Container_1.dll and related App_Web_* assemblies) on Exchange servers. GhostContainer is a modular .NET implant built from open-source components: a Neo-reGeorg-derived proxy/tunnel module (HTTP proxying and TCP socket forwarding via custom headers), ysoserial's GhostWebShell class, and CVE-2020-0688 exploit code drawn from the public ExchangeCmdPy.py framework. Its Stub component receives AES-encrypted, compressed commands through the x-owa-urlpostdata HTTP header, decrypts them using a key derived from the stolen ASP.NET machine validation key, and returns base64-encoded results embedded in a VIEWSTATE parameter carrying the same '/wEPDwUKLTcyODc4' prefix observed in the CVE-2020-0688 exploitation toolchain. To blend into legitimate traffic and impede detection and response, the Stub patches amsi.dll to bypass the Antimalware Scan Interface and patches ntdll.dll to disable Windows Event Logging.

For lateral movement, NightEagle exploits the BlueKeep RDP vulnerability (CVE-2019-0708) — a critical, pre-authentication use-after-free in Remote Desktop Services affecting Windows 7 SP1 and Windows Server 2008/2008 R2 — to create a local account and add it to the local Administrators and Remote Desktop Users groups on targeted hosts. To move RDP traffic covertly, the group combines the legitimate Microsoft Dev Tunnels service (exposing port 3389 via attacker-controlled *.devtunnels.ms subdomains) with the public rdp2tcp utility, which tunnels TCP traffic over an established RDP virtual channel (visible in Windows Event IDs 132/148 as a channel named 'rdp2tcp'), and with netsh interface portproxy rules to redirect traffic between ports (e.g., 443 to internal SMB). The group also uses the Impacket toolkit's atexec module to run commands via the Windows Task Scheduler RPC interface on remote hosts. With a persistent foothold, NightEagle conducts DCSync attacks — issuing directory-replication requests that impersonate a domain controller to replicate the AD Domain-Password object and harvest password hashes for privileged accounts — and requests Kerberos service tickets carrying an unusual combination of Forwardable, Proxiable, and Renewable flags, consistent with ticket-relay/delegation-abuse activity rather than routine authentication. Malicious executables are masqueraded with names mimicking legitimate software (AdobeSync.exe, adobe_32.exe, trueconf.exe, trueconf-broker.exe, 1cbroker.exe, 1c-office-plugin.exe) and staged via GitHub repositories disguised as unrelated open-source projects.

Kaspersky assesses the group updated its persistence and lateral-movement tradecraft specifically to support the geographic expansion into Russia, indicating continued investment in the toolset rather than a one-off campaign.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1505.003 Web Shell
- T1136.001 Local Account
- T1098.007 Additional Local or Domain Groups
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1036.005 Match Legitimate Resource Name or Location
- T1573.001 Symmetric Cryptography
- T1620 Reflective Code Loading
- T1003.006 DCSync
- T1558 Steal or Forge Kerberos Tickets
- T1021.001 Remote Desktop Protocol
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090.001 Internal Proxy

## Sources

- [NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers](https://gbhackers.com/nighteagle-attack-chain/)
- [NightEagle APT targets Russian organizations (GhostContainer and tunneling)](https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/)
- [GhostContainer backdoor for Exchange servers](https://securelist.com/ghostcontainer/116953/)
- [GhostContainer discovered: Kaspersky identifies a new backdoor targeting Microsoft Exchange servers](https://www.kaspersky.com/about/press-releases/ghostcontainer-discovered-kaspersky-identifies-a-new-backdoor-targeting-microsoft-exchange-servers)
- [NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors](https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html)
- [Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers](https://thehackernews.com/2026/09/three-threat-groups-target-russian.html)
- [Hacking group 'NightEagle' targeting China's high-tech sector expands operations to Russia](https://therecord.media/hacking-group-nighteagle-expands-russia-china)
- [CVE-2019-0708 (BlueKeep) - NVD](https://nvd.nist.gov/vuln/detail/cve-2019-0708)
- [CVE-2020-0688 - NVD](https://nvd.nist.gov/vuln/detail/cve-2020-0688)
- [ZDI-20-258: Microsoft Exchange Server ValidationKey Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-20-258/)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2019-0708](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2020-0688](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688)
- [rdp2tcp - RDP virtual-channel tunneling tool](https://github.com/Synacktiv-contrib/rdp2tcp)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2606