Three Clusters Hit Russian Firms

Three separate intrusion sets have converged on one region's corporate networks, and each is running a different playbook: a long-running espionage crew tunneling into internal systems, a hacktivist collective that has traded defacements for disk-wiping payloads, and a financially motivated group now fielding a backdoor built from scratch. Kaspersky has published findings on all three, tracking them as NightEagle, Hacking Cat, and Toy Ghouls, with Russian enterprises as the common target.

NightEagle Starts at the VPN Edge

The first cluster, NightEagle (also tracked as APT-Q-95), has been active since at least 2023. According to Kaspersky, initial access in most incidents came through compromised valid credentials rather than an exploited perimeter flaw. The attackers logged into corporate VPNs using accounts they already had the keys to.

The source of those connections is notable. Kaspersky said the VPN sessions originated from IP addresses in the Russian segment tied to Cloudflare WARP tunnels, alongside addresses associated with European virtual infrastructure providers. That combination lets the operator blend into ordinary remote-work traffic while keeping the true origin of the session at least one layer removed.

Once inside, NightEagle's goal is persistence and movement. The group's tooling centers on GhostContainer, a modular backdoor that had already surfaced in reporting from July 2025. The implant gives its operators full access to a compromised Microsoft Exchange Server, the ability to run arbitrary code, file operations, and the capacity to load further modules on demand.

Kaspersky described how the malware hides: it impersonates a common server component so it blends into normal operations, and it can double as a traffic redirection point or tunnel. Earlier campaigns involving the same backdoor targeted a government agency and a high-tech company in Asia, so the tool predates this Russian-focused wave.

"It incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility," Kaspersky explained. "All of these components are publicly available on GitHub."

Kaspersky's analysis is the source of that description of the backdoor's assembly. The vendor's write-up notes the implant is stitched together from code anyone can download, which lowers the development cost for the operator and complicates any attempt to fingerprint the tool by its codebase.

The Delivery Path Into Exchange

How GhostContainer actually lands on an Exchange server remains unresolved. Kaspersky said the exact delivery method is unknown, but its working assessment is that the attackers extracted the cryptographic keys the server uses from the ASP.NET configuration, then overwrote the VIEWSTATE framework parameter and injected a payload into it. The effect is that the backdoor launches in memory rather than from a file on disk.

That in-memory execution matters for defenders because it leaves fewer artifacts for endpoint tooling to flag. It also means the implant can be revived as long as the server's configuration remains in the state the attackers left it.

From the Exchange foothold, NightEagle pivots inward. Kaspersky observed the group downloading tunneling tools to redirect network traffic over RDP, specifically using Microsoft dev tunnels and an open-source program called rdp2tcp. Both are legitimate utilities, which is precisely what makes them useful to an intruder trying to look unremarkable.

Privilege escalation and lateral movement then run through Active Directory weaknesses. The operators reused the tunnels they had already established to reach internal infrastructure systems. Kaspersky said this included exploitation of CVE-2019-0708, the flaw known as BlueKeep, to create a local account on a system and add it to both the Administrators and Remote Desktop Users groups.

The group also attempted a DCSync attack to impersonate a domain controller. Pulled together, the end state Kaspersky describes is a familiar one: durable persistence inside the victim's infrastructure, password hashes for domain accounts, long-lived Kerberos tickets that grant legitimate-looking access to target resources, and eventually reach into domain controllers and the victim's entire Active Directory environment.

Hacking Cat Switches to Encryption

The second cluster is a different animal. Hacking Cat is a pro-Ukrainian hacktivist entity with a history of website defacements and data breaches stretching back to February 2024. In recent months, Kaspersky said, the group has shifted tactics and pivoted toward encryption and destructive attacks.

"Hacking Cat actively collaborates with other hacktivists such as Cyber Anarchy Squad and the Ukrainian Cyber Alliance, which can complicate the attribution of tools to specific attackers," Kaspersky said.

Its intrusion route relies on Exchange server flaws, with Kaspersky citing CVE-2021-26855 and CVE-2026-42897 as the vulnerabilities weaponized to deliver a Go-based remote access trojan the vendor calls Gorilla RAT. The implant can tunnel traffic, giving whoever operates it a path into the victim's internal network.

After launch, Gorilla RAT connects to a remote server, registers the victim, and waits for instructions. Kaspersky lists the capabilities as running arbitrary commands, enumerating processes, gathering system information, uploading and downloading files, and opening or closing a TCP tunnel.

The group also deploys multiple variants of a ransomware family called Monkey, written in Rust, .NET, C++, and Golang, aimed at Windows, Linux, and VMware ESXi systems. Kaspersky dates the earliest Monkey artifact to late summer 2025. Before encryption begins, the malware terminates unnecessary processes and takes steps to inhibit system recovery.

"A Rust-based variant of Monkey Ransomware generates a 32-byte key and encrypts the victim's files using ChaCha20-Poly1305," Kaspersky said. "Some variants do not store the key anywhere, which effectively turns them into full-fledged wiper malware, yet they still leave a ransom note. Other variants, on the other hand, store the key but do not include any contact information in the note."

The behavior across the other variants is worth separating out, since each one carries a distinct set of destructive options:

• The .NET variant generates a 32-byte key, sends it to the command-and-control server, and encrypts victim files using AES-256-CBC. It can escalate privileges, disable Windows recovery mechanisms, extract Microsoft Outlook credentials and send them to the C2 server, delete files with .bak, .backup, .bkf, and .bck extensions, and remove itself after execution.
• The C++ variant offers similar functionality but can establish persistence through a scheduled task or a RunOnce registry key. It clears system logs, disables logging, wipes PowerShell command history and the Windows Command Prompt, bypasses AMSI, turns off Event Tracing for Windows, configures Microsoft Defender exclusions for the encryptor, makes registry modifications to disable Task Manager and the Windows Command Prompt, obtains the public IP address by querying api.ipify[.]org and ipapi[.]co, and disables backup, database, and recovery mechanisms including the Volume Shadow Copy Service.
• The Golang variant, used mainly against Linux and ESXi, establishes persistence via a crontab entry, disables SELinux and AppArmor, and attempts to delete volume shadow copies.

That last detail drew a pointed observation from the vendor. Kaspersky theorized that the Golang version's shadow-copy removal "serves no purpose in Linux and ESXi environments – a fact that suggests the attackers were careless and likely used AI in developing the toolkit."

Borrowed Tools, Shared Authorship

Hacking Cat's operations extend beyond Monkey. Working with Cyber Anarchy Squad, another pro-Ukraine hacktivist group, it has delivered a separate ransomware strain called ClearWater through a batch script. Kaspersky assesses ClearWater to be distributed under a ransomware-as-a-service model to pro-Ukrainian hacktivist crews.

In a second collaboration, this time with the Ukrainian Cyber Alliance, the group deployed a wiper called Nemo Wiper. That tool overwrites files with random bytes and fills the remaining free disk space with files carrying random alphanumeric names and a .lock extension — a method that leaves little room for recovery.

"Different hacktivist groups are using the same self-written tools in different attacks, including multi-stage infection chains," Kaspersky noted. "This may indicate the existence of a common source for such tools – for example, a developer or a small group of developers who create, maintain, and modify the malware, which is subsequently used by various hacktivist groups."

The vendor's assessment did not go unanswered. After the report was published, Hacking Cat posted on its Telegram channel that "a couple of the tools are ours, but the lockers are definitely not." The group also alleged that Kaspersky is attributing tools from entirely unrelated actors to it and said the vendor should "learn to reverse-engineer groups better."

That kind of public pushback is not unusual when a hacktivist crew's toolkit overlaps with another's, but it does highlight how much of the attribution in this space rests on shared code rather than declared operators.

Toy Ghouls Builds Its Own Backdoor

The third cluster, Toy Ghouls — also known as Bearlyfy, Laboo.boo, and Feral Wolf — has followed an escalation path of its own. Kaspersky said the financially motivated group, active since 2025, moved from leaked Babuk and LockBit ransomware builders to its own custom GenieLocker ransomware, and now to a bespoke backdoor.

That backdoor was first detected in July 2026 and shows up in two variants. The first, mqtt-bird-agent 0.1.0, uses a HiveMQ MQTT broker for command and control. The second, matrix-bird-agent 0.1.0, communicates through Element, a Matrix-based end-to-end encrypted messenger app.

"In this campaign, the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems," Kaspersky said. "The group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this."

The Bird Agent backdoor can run inside an interactive command-line session and can also set up persistence as a Windows service. On launch it looks for a configuration file named config.toml in the same directory it resides in; alternatively, the full path can be supplied through the "-c" or "--config" option at runtime.

The malware reads that file and partially encrypts it with a key derived from the victim machine's MachineGuid value stored in the Windows Registry, binding the configuration to that one system. If it cannot decrypt the configuration on a later run, it stops executing — a simple check that frustrates anyone trying to lift the config and reuse it elsewhere.

Depending on the variant, the configuration holds either the cluster identifier used to reach the HiveMQ MQTT broker, or the Element internal room identifier plus the access token needed to enter that room. If the parameter is empty, the backdoor is designed to prompt for the token during installation and store it afterward.

Once connected, Bird Agent sends system information and issues HTTP GET requests to the HiveMQ broker to fetch commands from the C2 server. It executes them through PowerShell in hidden mode using the arguments -NonInteractive -NoProfile -Command, then transmits the results back. The Element variant works much the same way, with the main difference being that received commands run through the Windows command-line interface and the output is returned to the C2 server.

"The new tools use unconventional channels to communicate with their C2 server: the HiveMQ MQTT broker and the Matrix-based Element messenger," Kaspersky said. "This shift away from publicly available open-source projects toward custom-built tools suggests that Toy Ghouls is working to make its attacks more sophisticated and to evade detection for longer."

What Defenders Take From This

Read together, the three campaigns show a handful of consistent pressure points that defenders can test against their own environments.

• Valid credentials remain the front door. NightEagle's VPN access came from compromised accounts, not a brute-force break-in, which puts weight on credential hygiene, session monitoring, and knowing what a normal login looks like for each user.
• Exchange and Active Directory stay in the crosshairs. Across the clusters, the cited flaws include CVE-2020-0688, CVE-2021-26855, CVE-2026-42897, and CVE-2019-0708, plus DCSync and Kerberos abuse — a mix of unpatched server components and identity-layer misconfigurations.
• Legitimate tools do the work. Microsoft dev tunnels, rdp2tcp, Evil-WinRM, and WinRM-fs all have sanctioned uses, which means blocking them outright is rarely practical and detection has to focus on context.
• Backups are the deciding factor. Several Monkey variants either do not store the encryption key or disable recovery mechanisms such as the Volume Shadow Copy Service, and Nemo Wiper fills free disk space outright. Where recovery tooling is disabled, restoration depends entirely on offline copies.

The most immediate question for any organization is whether it has independent, tested backups and whether its recovery tooling can be reached if an attacker disables it first. The second is whether the organization's remote-access surface — VPN concentrators, Exchange servers, and identity infrastructure — has been reviewed against the specific flaws and credential paths the three groups rely on, rather than just patched on a schedule.

The overlap in tooling between hacktivist crews also has a quieter implication. If shared developers are supplying malware to multiple groups, then defenses tuned to one crew's signature may miss the next one using the same code under a different banner — which suggests detection logic built around behavior, rather than a group name, may hold up longer. Russian enterprises are the current focus, but the tools themselves, particularly the open-source components feeding GhostContainer, are not geographically bound.