Kaspersky: Three Groups Attack Russian Firms With Backdoors

Kaspersky has detailed three separate threat activity clusters targeting Russian enterprises, using backdoors, ransomware, and data-wiping malware. The clusters, tracked as NightEagle, Hacking Cat, and Toy Ghouls, use stolen VPN credentials, Microsoft Exchange vulnerabilities, and custom-built malware to move through corporate networks.

NightEagle, also known as APT-Q-95, has been active since at least 2023. In most incidents the attackers used compromised valid credentials to gain access to corporate virtual private networks, or VPNs, which are encrypted connections that let remote workers reach internal systems. Those VPN connections originated from IP addresses linked to Cloudflare WARP tunnels and from addresses associated with European virtual infrastructure providers. Once inside, the group deployed a modular backdoor called GhostContainer on Microsoft Exchange servers. A backdoor is a hidden way for an attacker to return to a system later. GhostContainer gives its operators complete access to a victim Exchange server, allowing them to run arbitrary code, perform file operations, and load additional modules. It disguises itself as a common server component and can also act as a tunnel or traffic redirector. Kaspersky notes that the malware includes pieces from open-source projects such as Neo-reGeorg, an exploit for CVE-2020-0688, and the GhostWebShell class from ysoserial, all publicly available on GitHub.

Kaspersky says the exact method used to deliver GhostContainer to Exchange servers is unknown. The vendor believes the attackers extracted cryptographic keys from the server's ASP.NET configuration, overwrote the VIEWSTATE framework parameter, and injected a payload so the backdoor launched in memory. To move laterally, NightEagle downloaded tunneling tools to redirect network traffic over the Remote Desktop Protocol using Microsoft dev tunnels and an open-source program called rdp2tcp. For elevated privileges, the group exploited vulnerabilities in Active Directory, the Microsoft service that manages user accounts and permissions. That included CVE-2019-0708, also known as BlueKeep, to create a local account and add it to the Administrators and Remote Desktop Users groups. The attackers also attempted a DCSync attack to impersonate the domain controller, the server that authenticates users and enforces security policies. The end goal is persistent access, stolen password hashes for domain accounts, and long-lived Kerberos tickets so the attackers can reach domain controllers and the entire Active Directory infrastructure.

Hacking Cat is a pro-Ukrainian hacktivist group with a history of website defacements and data breaches since February 2024, but it has recently shifted to encryption and destructive attacks. Kaspersky says the group collaborates with other hacktivist crews such as Cyber Anarchy Squad and the Ukrainian Cyber Alliance, which makes it harder to attribute specific tools to specific attackers. Hacking Cat has weaponized Microsoft Exchange vulnerabilities including CVE-2021-26855 and CVE-2026-42897 to deliver a Go-based remote access trojan called Gorilla RAT. A remote access trojan, or RAT, is a program that lets an attacker control a computer from afar. Gorilla RAT can tunnel traffic so the operator reaches the victim's internal network. After launching, it connects to a remote server, registers the victim, and waits for instructions to run commands, list processes, gather system information, upload or download files, and open or close a TCP tunnel. The same group also delivers multiple variants of a ransomware family called Monkey, written in Rust, .NET, C++, and Golang, targeting Windows, Linux, and VMware ESXi systems. The earliest Monkey ransomware artifact dates to late summer 2025. The malware terminates unnecessary processes and inhibits system recovery before encryption.

Kaspersky describes the Monkey variants in detail. A Rust-based version generates a 32-byte key and encrypts victim files with ChaCha20-Poly1305. Some variants do not store the key anywhere, which turns them into full wiper malware while still leaving a ransom note. Others store the key but omit contact information. The .NET variant generates a 32-byte key, sends it to a command-and-control server, and encrypts files with AES-256-CBC. It can escalate privileges, disable Windows recovery, extract Microsoft Outlook credentials, delete files with .bak, .backup, .bkf, and .bck extensions, and remove itself after execution. The C++ variant adds persistence through a scheduled task or a RunOnce registry key, clears system logs, disables logging, wipes PowerShell and Command Prompt history, bypasses AMSI, turns off Event Tracing for Windows, configures Microsoft Defender exclusions, disables Task Manager and Command Prompt through registry changes, queries api.ipify.org and ipapi.co for the public IP address, and disables backup, database, and recovery mechanisms including Volume Shadow Copy Service. The Golang variant, used mainly against Linux and ESXi, creates a crontab entry for persistence, disables SELinux and AppArmor, and attempts to delete volume shadow copies. Kaspersky notes that the Golang version includes removal of shadow copies, which serves no purpose on Linux or ESXi, suggesting the attackers were careless and likely used AI in developing the toolkit.

Hacking Cat has also worked with Cyber Anarchy Squad to deliver a different ransomware strain called ClearWater via a batch script, and ClearWater is assessed to be distributed under a ransomware-as-a-service model to pro-Ukrainian hacktivist crews. In another operation with the Ukrainian Cyber Alliance, the group deployed a wiper called Nemo Wiper that overwrites files with random bytes and fills free disk space with files using random alphanumeric names and the .lock extension. Kaspersky notes that different hacktivist groups are using the same self-written tools in different attacks, including multi-stage infection chains, which may indicate a common developer or small group maintaining the malware. After the report was published, Hacking Cat posted on its Telegram channel that a couple of the tools are theirs but the lockers are definitely not, and accused Kaspersky of attributing tools from unrelated actors and of needing to learn to reverse-engineer groups better.

The third cluster, Toy Ghouls, also known as Bearlyfy, Laboo.boo, and Feral Wolf, is a financially motivated group active since 2025. It moved from leaked Babuk and LockBit ransomware builders to its own GenieLocker ransomware and now to a custom backdoor first detected in July 2026. The backdoor appears in two variants: mqtt-bird-agent 0.1.0, which uses the HiveMQ MQTT broker for command and control, and matrix-bird-agent 0.1.0, which uses Element, a Matrix-based end-to-end encrypted messenger, for command and control. Kaspersky says the attackers use Windows Remote Management, or WinRM, to deliver the backdoors and their configuration fil