NightEagle espionage group expands targeting from China to Russia

A cyberespionage group tracked as NightEagle, also known as APT-Q-95, has widened its operations from China to Russian companies, according to research published by Kaspersky. The group has been active since at least 2023 and had previously concentrated on targets in Asia.

Kaspersky investigated several incidents at Russian businesses over the past year. In most cases the attackers used stolen credentials to reach corporate networks through VPNs, then targeted Microsoft Exchange email servers and installed a backdoor called GhostContainer, which gives remote control of compromised servers, evades some Windows security and logging mechanisms, and redirects network traffic.

The researchers could not establish how the backdoor was initially planted, but believe the group used a previously observed technique that extracts encryption keys from Exchange and manipulates Microsoft’s web application framework to run the backdoor in server memory. The hackers also stored tooling in GitHub repositories disguised with names resembling legitimate software, including AdobeSync and TrueConf.

After gaining a foothold, NightEagle exploited weaknesses in Active Directory to escalate privileges and move laterally, maintaining access, stealing credentials and impersonating legitimate users, with domain controllers as a final objective. Kaspersky did not name the affected companies, say how many were hit, or give a likely motive.

NightEagle first came to public attention in July 2025, when Chinese firm QiAnXin described the operation and linked it to attacks on China’s defence, semiconductor, AI and quantum technology sectors. Chinese researchers have previously associated the group with North America, a claim that remains unconfirmed and leaves attribution uncertain.