Kaspersky Tracks Three Threat Clusters Targeting Russian Enterprises

Kaspersky has identified three threat activity clusters targeting enterprises in Russia: NightEagle, Hacking Cat and Toy Ghouls. Their campaigns combine stolen VPN credentials, Microsoft Exchange exploitation, remote-access backdoors, ransomware and destructive wipers across Windows, Linux and VMware ESXi environments.

The groups differ in motivation and tooling, but the reports describe a common operational risk: an initial foothold can be expanded through tunnelling, credential theft, lateral movement and interference with recovery mechanisms. Kaspersky said NightEagle, also known as APT-Q-95, has been active since at least 2023, while financially motivated Toy Ghouls has operated since 2025.

NightEagle combines VPN access with Exchange and Active Directory attacks

In most NightEagle incidents, attackers accessed corporate VPNs with compromised valid credentials. Kaspersky observed connections from Russian IP addresses linked to Cloudflare WARP tunnels and from IP addresses associated with European virtual infrastructure providers.

The group deployed the modular GhostContainer backdoor against Microsoft Exchange Server. GhostContainer can provide complete access to the server, execute arbitrary code, handle files, load modules and operate as a traffic redirection or tunnelling mechanism. Its delivery method remains unknown, although Kaspersky believes attackers may have extracted ASP.NET cryptographic keys, overwritten the VIEWSTATE parameter and injected an in-memory payload.

For movement inside networks, NightEagle downloaded tunnelling tools, including Microsoft dev tunnels and rdp2tcp, to redirect traffic through RDP. Kaspersky also recorded exploitation of Active Directory vulnerabilities, BlueKeep tracked as CVE-2019-0708, and DCSync activity intended to impersonate a domain controller. The stated objectives were persistence, collection of domain password hashes, use of long-lived Kerberos tickets and access to domain controllers.

Hacking Cat shifts toward encryption and destructive operations

Hacking Cat, a pro-Ukrainian hacktivist group linked by Kaspersky to website defacements and data breaches since February 2024, has recently moved toward encryption and destructive attacks. The vendor said the group collaborates with Cyber Anarchy Squad and the Ukrainian Cyber Alliance, which can complicate attribution of tools.

The attackers exploited Exchange vulnerabilities including CVE-2021-26855 and CVE-2026-42897 to deploy the Go-based Gorilla RAT. The remote-access tool can tunnel traffic, run commands, enumerate processes, collect system information, transfer files and control a TCP tunnel.

Hacking Cat also used Monkey ransomware variants written in Rust, .NET, C++ and Golang. The Rust version generates a 32-byte key and uses ChaCha20-Poly1305. Some variants do not retain the key, effectively making them wipers even though they leave a ransom note. Other variants disable recovery features, remove backups or logs, establish persistence, and target Windows, Linux and ESXi systems. Kaspersky also described ClearWater ransomware and Nemo Wiper deployments in collaborative operations; Hacking Cat later disputed parts of the vendor's attribution on Telegram.

Toy Ghouls introduces a custom backdoor

Toy Ghouls has progressed from leaked Babuk and LockBit builders to GenieLocker ransomware and a custom backdoor called Bird Agent. First detected in July 2026, mqtt-bird-agent 0.1.0 uses the HiveMQ MQTT broker for command-and-control, while matrix-bird-agent 0.1.0 uses the Matrix-based Element messenger.

Kaspersky said the group used Windows Remote Management, Evil-WinRM and WinRM-fs to deliver the backdoor and its configuration. Bird Agent can run commands and persist as a Windows service. It binds its configuration to a victim system using a key derived from the Windows MachineGuid value, then executes received commands through hidden PowerShell or the Windows command line, depending on the variant.

For security teams, the reports reinforce the need to protect VPN credentials, promptly address exposed Exchange and Active Directory weaknesses, watch for unusual tunnelling and remote-management activity, and validate that backups and recovery processes remain available after an intrusion.