NightEagle (APT-Q-95) has conducted intrusions against Russian organizations using compromised VPN credentials and the GhostContainer backdoor deployed on Microsoft Exchange servers. The group abuses Microsoft Dev Tunnels combined with RDP tunneling to maintain covert access and move laterally through victim networks, targeting Active Directory and exploiting legacy RDP vulnerabilities. Initial access, Exchange compromise, and sustained tunneling through legitimate Microsoft services demonstrate mature tradecraft designed to evade detection.
// Get alerts for Microsoft Azure