NightEagle is entering Russian corporate VPNs with valid stolen credentials

Kaspersky's Global Emergency Response Team says it could not determine how the backdoor reached the Exchange servers. It assesses with high confidence that the operators pulled the Exchange cryptographic keys out of the ASP.NET configuration, overwrote the VIEWSTATE parameter, and injected a payload that started GhostContainer in memory ^[8]. That path turns on possession of the machine keys.

GhostContainer's own code carries an exploit for CVE-2020-0688, along with the Neo-reGeorg tunnel and the GhostWebShell class from ysoserial, all of it public on GitHub ^[7]. The CVE identifier is from 2020, three years older than the earliest NightEagle activity Kaspersky dates ^[22]. The assembly has three classes ^[9]. Stub takes C2 commands in x-owa-urlpostdata headers and overwrites addresses in amsi.dll and ntdll.dll to blind AMSI and the Windows event log ^[10]. A second class builds virtual paths from fakePath and fakePageName parameters and hands requests to the third ^[11], which proxies traffic and forwards sockets ^[12].

The lateral movement leans on services a network team cannot simply block. Microsoft dev tunnels is a Microsoft feature that publishes a local web service on a *.*.devtunnels.ms domain, and the operators used it to expose port 3389 on compromised hosts ^[17]. On top of that they ran rdp2tcp, a publicly available tool that carries arbitrary TCP inside an established RDP session, with a server component on the target and a client on the attacker side ^[18]. Kaspersky says the pairing lets them keep network access through legitimate services ^[19].

Virtual channel opens and closes land as event IDs 132 and 148 in the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS operational log, normally carrying RemoteFX channel names such as XPSRD, cliprdr and Microsoft::Windows::RDS::DisplayControl ^[20]. Under rdp2tcp those same events show the channel name rdp2tcp, or whatever random alphanumeric string the operator chose ^[21]. The tool archives came from GitHub repositories dressed as JavaScript mirrors and browser theme packs ^[15], and the binaries inside used names such as 1cbroker.exe, trueconf.exe and adobe_32.exe ^[16]. Kaspersky detects the backdoor as Trojan.MSIL.GhostContainer.gen ^[13].

Kaspersky's earlier reporting put NightEagle, also tracked as APT-Q-95, on organizations in Asia ^[2]. This campaign is Russian businesses, across several incidents its responders worked in the past year ^[1]. Every step here runs on what was already in place, with no fresh vulnerability anywhere in the chain. Configuration breaks it: a second factor on the VPN so a stolen password is not sufficient ^[4], rotated Exchange machine keys, and an alert on RDP virtual channel names that RemoteFX never uses.