Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle , Hacking Cat , and Toy Ghouls , according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle aka APT-Q-95, a threat actor known ...

NightEagle targets Russian companies

Over the past year, our Global Emergency Response Team GERT has investigated several incidents involving the NightEagle group also tracked as APT-Q-95. This group has been active since at least 2023 and originally focused on organizations in Asia. We have now identified attacks by the group...

New GhostContainer Malware Hits High-Value MS Exchange Servers in Asia

Kaspersky's SecureList reveals GhostContainer, a new, highly customized backdoor targeting government and high-tech organizations in Asia via Exchange server vulnerabilities. Learn how this APT malware operates and how to stay protected...

GhostContainer backdoor: malware compromising Exchange servers of high-value organizations in Asia

In a recent incident response IR case, we discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sample suggests that the Exchange server was likely compromised via a known N-day vulnerability. Our...

PT-2020-1715

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description A remote code execution issue exists in Microsoft Exchange Server due to the failure to properly create unique keys during installation. This flaw, also referred to as a...