// Microsoft 365HIGH
NightEagle (APT-Q-95) has deployed GhostContainer backdoor on Microsoft Exchange servers and abused Microsoft Dev Tunnels to establish persistent access and hide RDP connections within corporate networks. The threat group targets Russian and Asian organizations with compromised VPN credentials, Exchange server exploitation, and Active Directory attacks for lateral movement.
// Get alerts for Microsoft 365