/
← Voltar ao feed
high exploit público

NightEagle (APT-Q-95) targets Russian organizations with GhostContainer Exchange backdoor and RDP tunneling

1 fonte(s) · 1 atualização(ões) · publicado 16/09/2026 07:00 · coletado há 3 dias

Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from European virtual infrastructure providers. They deploy the GhostContainer backdoor on Microsoft Exchange servers, then move laterally over RDP using tunneling tools and exploit Active Directory weaknesses to compromise domain controllers. The exact delivery method of the backdoor was not determined, though Kaspersky assesses with high confidence that a known VIEWSTATE deserialization technique was used.

6 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2020-0688, CVE-2019-0708. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-48168 ↗ · remoto · windows · pub. 05/03/2020 verificado

    Exchange Control Panel - Viewstate Deserialization (Metasploit)

    This Metasploit module exploits CVE-2020-0688 in the Exchange Control Panel, where Microsoft Exchange uses the same fixed cryptographic keys on every installation. With those keys, an attacker forges a signed ViewState that the server deserializes, running commands as SYSTEM. It needs network access to the HTTPS interface, valid credentials of any mailbox user and an unpatched server. It is a mature, working exploit, with a check that tests whether forged signatures are accepted.

    CVE-2020-0688 · autor: Metasploit · explicação gerada por IA
  2. exploit-db.com · EDB-48153 ↗ · remoto · windows · pub. 02/03/2020 não verificado

    Microsoft Exchange 2019 15.2.221.12 - Authenticated Remote Code Execution

    This script abuses the Exchange Control Panel web component through the fixed cryptographic validation key that every affected Exchange server shares (CVE-2020-0688). The attacker needs network access to the web interface, any valid mailbox login, and an unpatched Exchange 2010 SP3 through 2019 CU4 server. It logs in, collects the session ID, checks for the vulnerable view state, then forges a signed serialized object that makes the server run an operating system command of the attacker's choice. It looks like a working, tested exploit that genuinely matches the CVE.

    CVE-2020-0688 · autor: Photubias · explicação gerada por IA
  3. exploit-db.com · EDB-47683 ↗ · remoto · windows_x86 · pub. 19/11/2019 não verificado

    Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free

    This script targets BlueKeep (CVE-2019-0708), a use-after-free in the Windows RDP service's virtual channel handling, on 32-bit Windows 7. The attacker needs only network access to the RDP port of an unpatched host with Remote Desktop enabled; no authentication or user interaction is required. It sprays the kernel pool with shellcode, triggers the free, then refills it with fake objects so the kernel runs the attacker's code and launches a reverse shell. It looks like a working but unreliable exploit (the author claims about 80% success on a test VM), and failures can crash the target.

    CVE-2019-0708 · autor: 0xeb-bp · explicação gerada por IA

Detalhes técnicos

  • GhostContainer is an in-memory .NET assembly with three classes. Stub handles C2 commands received via x-owa-urlpostdata headers and evades AMSI and Windows Event Log by overwriting addresses in amsi.dll and ntdll.dll. App_Web_843e75cf5b63 takes the fakePath and fakePageName parameters and creates virtual paths. App_Web_8c9b251fb5b3 provides traffic proxying and socket forwarding. It reuses open-source components: Neo-reGeorg, an exploit for CVE-2020-0688 and the GhostWebShell class from ysoserial.
  • Likely delivery: extracting Exchange cryptographic keys from the ASP.NET configuration, overwriting the VIEWSTATE parameter and injecting a payload that loads the backdoor in memory.
  • Tools were hosted in GitHub repositories with legitimate-looking names, and the archive contents were renamed to mimic legitimate software.
  • Tunneling combines Microsoft dev tunnels (*.devtunnels.ms) to expose RDP port 3389 with rdp2tcp, which tunnels TCP over RDP virtual channels. Impacket atexec creates scheduled tasks for port forwarding.
  • Lateral movement and privilege escalation: CVE-2019-0708 (BlueKeep) used to create a local account added to Administrators and Remote Desktop Users, Kerberos tickets requested with non-standard flags (Forwardable, Proxiable, Renewable), and DCSync to replicate the Domain-Password object.
  • Detection: Kaspersky detects the backdoor as Trojan.MSIL.GhostContainer.gen. Hunt for rdp2tcp channel names in RdpCoreTS/Operational.evtx events 132 and 148, DNS queries to dev tunnel domains, Impacket activity, and DCSync-like replication.

Remediação

  • Monitor for abnormal VPN logins from Cloudflare WARP and foreign virtual hosting ranges, and enforce MFA and credential hygiene.
  • Patch Exchange and Windows hosts (CVE-2020-0688, CVE-2019-0708) and protect or rotate Exchange machine keys.
  • Alert on devtunnels.ms DNS access, rdp2tcp virtual channel names, Impacket atexec scheduled tasks and DCSync activity.
  • Block or review downloads from the listed GitHub repositories.

Linha do tempo

  1. securelist.com ↗ · pub. 16/09/2026 07:00 · coletado 19/10 17:57 primeiro registro

    NightEagle (APT-Q-95) targets Russian organizations with GhostContainer Exchange backdoor and RDP tunneling

    ler a análise desta fonte

    Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from European virtual infrastructure providers. They deploy the GhostContainer backdoor on Microsoft Exchange servers, then move laterally over RDP using tunneling tools and exploit Active Directory weaknesses to compromise domain controllers. The exact delivery method of the backdoor was not determined, though Kaspersky assesses with high confidence that a known VIEWSTATE deserialization technique was used.

    Technical Details

    • GhostContainer is an in-memory .NET assembly with three classes. Stub handles C2 commands received via x-owa-urlpostdata headers and evades AMSI and Windows Event Log by overwriting addresses in amsi.dll and ntdll.dll. App_Web_843e75cf5b63 takes the fakePath and fakePageName parameters and creates virtual paths. App_Web_8c9b251fb5b3 provides traffic proxying and socket forwarding. It reuses open-source components: Neo-reGeorg, an exploit for CVE-2020-0688 and the GhostWebShell class from ysoserial.
    • Likely delivery: extracting Exchange cryptographic keys from the ASP.NET configuration, overwriting the VIEWSTATE parameter and injecting a payload that loads the backdoor in memory.
    • Tools were hosted in GitHub repositories with legitimate-looking names, and the archive contents were renamed to mimic legitimate software.
    • Tunneling combines Microsoft dev tunnels (*.devtunnels.ms) to expose RDP port 3389 with rdp2tcp, which tunnels TCP over RDP virtual channels. Impacket atexec creates scheduled tasks for port forwarding.
    • Lateral movement and privilege escalation: CVE-2019-0708 (BlueKeep) used to create a local account added to Administrators and Remote Desktop Users, Kerberos tickets requested with non-standard flags (Forwardable, Proxiable, Renewable), and DCSync to replicate the Domain-Password object.
    • Detection: Kaspersky detects the backdoor as Trojan.MSIL.GhostContainer.gen. Hunt for rdp2tcp channel names in RdpCoreTS/Operational.evtx events 132 and 148, DNS queries to dev tunnel domains, Impacket activity, and DCSync-like replication.

    Remediation

    • Monitor for abnormal VPN logins from Cloudflare WARP and foreign virtual hosting ranges, and enforce MFA and credential hygiene.
    • Patch Exchange and Windows hosts (CVE-2020-0688, CVE-2019-0708) and protect or rotate Exchange machine keys.
    • Alert on devtunnels.ms DNS access, rdp2tcp virtual channel names, Impacket atexec scheduled tasks and DCSync activity.
    • Block or review downloads from the listed GitHub repositories.