/
initial_access_vector:valid_accounts × criticity:high × latest_source_host:securelist.com × limpar

Resultados

2 casos · pág. 1/1

securelist.com · exploit público high

NightEagle (APT-Q-95) targets Russian organizations with GhostContainer Exchange backdoor and RDP tunneling

Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…

CVE-2020-0688 CVE-2019-0708 NightEagle APT-Q-95
securelist.com · high

PAYLOAD extortion group abuses domain-root GPO to disrupt a Middle East manufacturer without deploying a Windows encryptor

In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…

manufacturing