APT Incident Response

NightEagle is entering Russian corporate VPNs with valid stolen credentials

Kaspersky's incident response team says the group, previously seen working against targets in Asia, logged into VPNs from Cloudflare WARP and European hosting addresses, then ran the GhostContainer backdoor in memory on Exchange.