**Russian Enterprises Under Siege: NightEagle, Hacking Cat, and Toy Ghouls Unleash Diverse Cyber Campaigns**
Russian businesses are currently facing a multifaceted cyber threat landscape, with three distinct activity clusters—NightEagle, Hacking Cat, and Toy Ghouls—launching aggressive campaigns against the country’s enterprises. These groups range from state-sponsored actors to hacktivists and financially motivated ransomware operators, each employing unique techniques to compromise, disrupt, and extort their targets.
**NightEagle: Exploiting Identity and Active Directory Flaws**
One of the primary threats targeting Russian organizations is NightEagle, a group identified as APT-Q-95 that has been actively compromising networks since at least 2023. The group’s initial access strategy relies heavily on the abuse of compromised, valid credentials to breach corporate virtual private networks. To mask their origin, the attackers route their connections through Cloudflare WARP tunnels and IP addresses associated with European virtual infrastructure providers.
Once inside the network, NightEagle deploys GhostContainer, a modular backdoor specifically designed to target Microsoft Exchange servers. This malware masquerades as a standard server component to blend in with normal traffic, allowing operators to execute arbitrary code, manipulate files, and load additional malicious modules. The delivery method involves manipulating ASP.NET configuration files and overwriting the VIEWSTATE framework parameter to inject and launch the payload directly in memory. The malware incorporates publicly available open-source components, including the Neo-reGeorg tunnel and exploits for known vulnerabilities, to avoid raising suspicion.
For lateral movement, the group utilizes tunneling tools such as rdp2tcp and Microsoft dev tunnels to redirect traffic via Remote Desktop Protocol. To escalate privileges, NightEagle exploits various Active Directory vulnerabilities, including the BlueKeep flaw (CVE-2019-0708), which allows the creation of local administrator accounts. The attackers also attempt to impersonate domain controllers using DCSync attacks to steal password hashes. Ultimately, their objective is to establish persistent access, harvest long-lived Kerberos tickets, and seize control of the entire domain infrastructure.
**Hacking Cat: From Hacktivism to Destructive Ransomware**
Hacking Cat is a pro-Ukrainian hacktivist entity that has been conducting website defacements and data breaches since early 2024. Recently, the group has pivoted toward more destructive and encryption-based attacks, weaponizing vulnerabilities in Exchange servers—specifically CVE-2021-26855 and CVE-2026-42897—to deploy Gorilla RAT. This Go-based remote access trojan creates secure tunnels within compromised networks, enabling operators to execute commands, enumerate processes, and transfer files remotely.
Alongside Gorilla RAT, Hacking Cat distributes multiple variants of Monkey Ransomware, built using languages including Rust, .NET, C++, and Golang to target Windows, Linux, and VMware ESXi systems. The Rust variant encrypts files using ChaCha20-Poly1305 and occasionally acts as a wiper, destroying encryption keys while still leaving a ransom note. The .NET variant uses AES-256-CBC for encryption, escalates privileges, disables Windows recovery mechanisms, and exfiltrates Microsoft Outlook credentials. The C++ variant focuses on maintaining persistence through scheduled tasks and registry keys, while disabling security features like AMSI and Windows Event Tracing, and configuring Microsoft Defender exclusions. A Golang variant specifically targets Linux and ESXi systems, attempting to disable SELinux and AppArmor, though its inclusion of features irrelevant to these platforms—such as deleting volume shadow copies—suggests it may have been hastily assembled using automated tools.
Hacking Cat also collaborates with other hacktivist factions, such as Cyber Anarchy Squad and the Ukrainian Cyber Alliance, to distribute threats like ClearWater ransomware and Nemo Wiper, a destructive malware that overwrites files with random bytes and fills disk space with junk data to prevent recovery. It is worth noting that Hacking Cat has publicly disputed the attribution of certain tools, claiming that not all lockers deployed under their banner are their own.
**Toy Ghouls: Shifting to Custom Backdoors**
Toy Ghouls—also known as Bearlyfy, Laboo.boo, and Feral Wolf—is a financially motivated group active since 2025. Having previously relied on leaked ransomware builders like Babuk and LockBit, the group has evolved to develop its own custom malware, including GenieLocker and a newly observed backdoor called Bird Agent.
First detected in mid-2026, Bird Agent arrives in two variants: mqtt-bird-agent, which communicates via the HiveMQ MQTT broker, and matrix-bird-agent, which uses the Element messaging application—a Matrix-based end-to-end encrypted platform—as its command-and-control channel. The attackers deliver the backdoor using Windows Remote Management (WinRM) and open-source tools such as Evil-WinRM and WinRM-fs.
Once executed, Bird Agent searches for a configuration file that is partially encrypted using a key derived from the victim machine’s unique MachineGuid registry value. If the malware cannot decrypt this file, it ceases execution. Upon successful connection to the C2 server, the backdoor sends system information and waits for commands, executing them via PowerShell or the standard command line depending on the variant. This deliberate shift toward unconventional, custom-built communication channels indicates a strategic effort by Toy Ghouls to evade detection and maintain long-term access to compromised systems.
***
**FAQ**
**Q: How does NightEagle initially gain access to victim networks?**
A: NightEagle primarily gains access by using compromised, valid credentials to log into corporate VPNs. Their connections are further disguised by routing through Cloudflare WARP tunnels and IP addresses linked to European cloud providers.
**Q: What is the purpose of Gorilla RAT deployed by Hacking Cat?**
A: Gorilla RAT is a Go-based remote access trojan used to establish secure tunnels within compromised networks. It allows threat actors to remotely execute commands, enumerate system processes, and upload or download files.
**Q: Which variant of Monkey Ransomware targets Linux and ESXi systems?**
A: The Golang variant of Monkey Ransomware is primarily designed to target Linux and VMware ESXi environments. It establishes persistence via crontab entries and attempts to disable security modules like SELinux and AppArmor.
**Q: Why is Toy Ghouls’ Bird Agent considered unusual?**
A: Bird Agent is unusual because it uses non-traditional command-and-control channels, specifically the HiveMQ MQTT broker and the Matrix-based Element messenger app. This approach helps the malware blend into normal network traffic and evade traditional security monitoring.
**Q: How do the attackers behind Bird Agent ensure the backdoor only runs on the intended system?**
A: The configuration file required for the backdoor to operate is encrypted using a key derived from the specific victim machine’s MachineGuid value stored in the Windows Registry. If the malware cannot decrypt this configuration, it stops running, effectively binding the payload to that single system.
***
**Conclusion**
The simultaneous targeting of Russian enterprises by NightEagle, Hacking Cat, and Toy Ghouls highlights a complex and evolving cyber threat landscape. While NightEagle leverages sophisticated identity and Active Directory exploitation to achieve deep network persistence, hacktivist groups like Hacking Cat are increasingly adopting destructive ransomware and wiper tools. Meanwhile, financially motivated actors such as Toy Ghouls are moving away from readily available open-source tooling in favor of bespoke backdoors that utilize unconventional communication methods. Together, these campaigns underscore the critical need for robust credential hygiene, timely patch management, and advanced network monitoring to defend against a diverse array of adversaries.
Thank you for reading
