Experts at Kaspersky Lab have published a series of reports on three activity clusters — NightEagle, Hacking Cat and Toy Ghouls — targeting Russian enterprises. The groups use fundamentally different attack chains: from a modular backdoor on Microsoft Exchange servers and exploitation of Active Directory vulnerabilities to ransomware with wiper functionality and non-standard command-and-control channels via an MQTT broker and the Element messenger. Organizations running Exchange Server and Windows-based infrastructure should immediately check that they have up-to-date patches for a number of critical vulnerabilities, including CVE-2019-0708 and CVE-2021-26855, which are listed in the CISA KEV catalog.
NightEagle: VPN, Exchange and lateral movement via old vulnerabilities
According to Kaspersky, the NightEagle group (also known as APT-Q-95) has been active since at least 2023. In most of the investigated incidents, the attackers obtained initial access via compromised corporate VPN credentials. Connections were made from IP addresses associated with Cloudflare WARP tunnels and European virtual infrastructure providers.
On Microsoft Exchange servers, the group deployed the modular backdoor GhostContainer, which provides full access to the server, the ability to execute arbitrary code, perform file operations and load additional modules. The backdoor masquerades as a standard server component and can function as a tool for traffic redirection. Kaspersky believes that GhostContainer includes components of several open projects: the Neo-reGeorg tunnel, an exploit for CVE-2020-0688 and the GhostWebShell class from the ysoserial utility. The exact delivery method of the backdoor has not been established, but the researchers are highly confident that the attackers extracted cryptographic keys from the ASP.NET configuration, overwrote the VIEWSTATE parameter and injected a payload that launched the backdoor in memory.
For lateral movement, NightEagle used tools for tunneling traffic over RDP — Microsoft dev tunnels and the open-source utility rdp2tcp. Notably, the use of rdp2tcp creates an opportunity for detection: RDP events 132 and 148 in the operational logs may contain the channel name “rdp2tcp” or random alphanumeric channel names set by the attackers. This is a hash-independent indicator suitable for proactive threat hunting.
In one of the investigated incidents, NightEagle exploited CVE-2019-0708 (BlueKeep) — a critical remote code execution vulnerability in Remote Desktop Services with an NVD CVSS 3.1 score of 9.8 Critical. The vulnerability affects Windows 7 SP1 and Windows Server 2008/2008 R2 SP1 and is included in the CISA KEV catalog. The attackers used it to create a local account and add it to the Administrators and Remote Desktop Users groups. In addition, attempts were recorded to impersonate a domain controller via a DCSync attack. The ultimate goal was to capture password hashes of domain accounts, obtain long-lived Kerberos tickets and compromise the entire Active Directory infrastructure.
Hacking Cat: ransomware, wipers and disputed attribution
The second group, Hacking Cat, is described by Kaspersky as a pro-Ukrainian hacktivist collective active since February 2024. Initially, the group focused on defacements and data leaks but, according to the researchers, has moved on to destructive attacks with encryption. Kaspersky notes that Hacking Cat cooperates with other hacktivist groups — Cyber Anarchy Squad and Ukrainian Cyber Alliance — which complicates attribution of specific tools.
According to the report, the group exploited vulnerabilities in Exchange servers, including CVE-2021-26855 (CVSS 3.1 score: 9.8 according to NVD, 9.1 according to Microsoft) and CVE-2026-42897 (included in CISA KEV with a remediation deadline of May 29, 2026), to deliver the Gorilla RAT Trojan written in Go. We have already written about the active exploitation of CVE-2026-42897 earlier.
Kaspersky also links the Monkey ransomware family to Hacking Cat. It is implemented in Rust, .NET, C++ and Golang for attacks on Windows, Linux and VMware ESXi. Some variants do not store the encryption key, effectively turning them into wipers, while still leaving a ransom note. The researchers noted that the Golang variant includes a function to delete volume shadow copies, which is meaningless on Linux and ESXi — this may indicate the use of AI in developing the toolset.
Important caveat: after the report was published, Hacking Cat disputed the attribution in its Telegram channel, stating that “a couple of the tools are ours, but the lockers definitely are not,” and accusing Kaspersky of attributing tools to completely unrelated actors. Thus, attributing the Monkey ransomware specifically to this group remains contentious.
Toy Ghouls: custom backdoor with non-standard C2 channels
The third group — Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf) — is, according to Kaspersky, financially motivated and has been active since 2025. Previously the group used leaked Babuk and LockBit builders, then its own GenieLocker ransomware, and has now moved on to the custom backdoor Bird Agent, first discovered in July 2026.
Bird Agent exists in two variants:
- mqtt-bird-agent 0.1.0 — uses the public MQTT broker HiveMQ (broker.hivemq.com) for command and control;
- matrix-bird-agent 0.1.0 — uses the Element messenger based on the Matrix protocol with end-to-end encryption.
The backdoors are delivered via Windows Remote Management (WinRM) using the open-source tools Evil-WinRM and WinRM-fs. The backdoor can persist as a Windows service. On first launch, it reads the config.toml configuration file and partially encrypts it with a key derived from the MachineGuid value in the Windows registry, binding the configuration to a specific machine. If it cannot decrypt the file on subsequent launches, the backdoor terminates.
The MQTT variant executes received commands via PowerShell in hidden mode, while the Element variant uses the Windows command line. The results are sent back to the command server. Kaspersky emphasizes that the shift from open tools to custom ones indicates increasing attack sophistication and the group’s desire to remain undetected for longer.
Comparative matrix and practical recommendations
The three described clusters use substantially different access and control chains. NightEagle combines VPN credentials, an Exchange backdoor, RDP tunneling and Active Directory exploitation. Hacking Cat, according to Kaspersky, delivers RATs and destructive payloads through Exchange vulnerabilities. Toy Ghouls uses WinRM to deliver service backdoors with atypical C2 channels. This means defenses must cover several attack surfaces simultaneously.
Recommended actions:
- Verify that patches are installed for CVE-2019-0708, CVE-2020-0688, CVE-2021-26855 and CVE-2026-42897 — all four vulnerabilities are listed in the CISA KEV catalog.
- Audit VPN connections for links to Cloudflare WARP IP addresses and atypical European providers.
- Review RDP event logs (IDs 132, 148) for non-standard channel names, including “rdp2tcp”.
- Monitor outbound connections to broker.hivemq.com and *.devtunnels.ms domains.
- Check for illegitimate Windows services created via WinRM and suspicious config.toml files located alongside executables.
- Ensure there are no legacy Windows 7 and Windows Server 2008 systems in the infrastructure; if they cannot be decommissioned, isolate them from the network.
The described campaigns show that Russian organizations are facing heterogeneous threats — from APT groups aiming for long-term presence in infrastructure to hacktivists with destructive goals. The top priorities are remediating the four listed vulnerabilities from the CISA KEV catalog and monitoring non-standard command-and-control channels (MQTT, Matrix/Element, dev tunnels), which are increasingly used to bypass traditional detection tools.
