kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · US

NightEagle

also tracked as apt q 95 1

1 story · 1 in the wild · September 17, 2026 – September 17, 2026

evidence: 1 observed

how they got in

  • stolen credentials 1 · Sep 17

sectors

  • defense 1 · Sep 17
  • government 1 · Sep 17
  • technology 1 · Sep 17

geography

  • europe 1 · Sep 17
  • russia 1 · Sep 17

malware and tools

  • ghostcontainer 1 · Sep 17

techniques

  • credential access 1 · Sep 17
  • defense evasion 1 · Sep 17
  • lateral movement 1 · Sep 17

attack phases seen

  • Defense evasion 1 · Sep 17
  • Initial access 1 · Sep 17
  • Lateral movement 1 · Sep 17
  • Persistence 1 · Sep 17

what we reported, newest first, grouped by story

September 17, 2026

  • NightEagle (APT-Q-95), previously focused on Asia, is now hitting Russian companies. Kaspersky's GERT found initial access via stolen VPN credentials from Cloudflare WARP and European VPS IP space, then the GhostContainer Exchange backdoor — assembled from Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell — believed delivered by extracting Exchange crypto keys from the ASP.NET config and injecting into VIEWSTATE. It takes commands via x-owa-urlpostdata headers and patches amsi.dll and ntdll.dll to blind AMSI and event logging, with RDP plus tunnelling tools for lateral movement. Securelist. · Sep 17 · observed · via stolen credentials · as apt q 95 · Threat Activity