An espionage group that spent years working targets in Asia has turned up inside Russian companies, and it did not need an exploit to get through the front door. Kaspersky's Global Emergency Response Team says the operators signed into corporate VPNs with valid stolen credentials, arriving from Russian IP addresses tied to Cloudflare WARP tunnels and from European virtual hosting providers. The group is NightEagle, also tracked as APT-Q-95, and it has been active since at least 2023.
An Exchange backdoor stitched from public code
Once inside, the attackers planted GhostContainer on Microsoft Exchange servers. It is a .NET assembly built largely out of parts anybody can download: the Neo-reGeorg tunnel, a public exploit for CVE-2020-0688, and the GhostWebShell class from the ysoserial toolkit. Commands reach it inside x-owa-urlpostdata HTTP headers, so the traffic reads like ordinary Outlook Web Access. Before it does anything else, it overwrites addresses in amsi.dll and ntdll.dll, blinding both the Antimalware Scan Interface and the Windows event log on that host.
Kaspersky could not establish how the backdoor was delivered and says so plainly. It assesses with high confidence that the attackers used a technique it has documented before, pulling Exchange's cryptographic keys out of the ASP.NET configuration, forging the VIEWSTATE parameter, and loading the payload into memory from there.
RDP through a Microsoft tunnel nobody blocks
For movement inside the network the group leaned on services that are supposed to be there. It published port 3389 through Microsoft dev tunnels, the legitimate mechanism that exposes a local service on a devtunnels.ms address, and paired it with rdp2tcp, a public tool that carries TCP traffic inside an existing RDP session. Scheduled tasks created with Impacket's atexec added netsh port proxies, quietly forwarding a listener on 443 to SMB on an internal host. The tooling came from GitHub repositories dressed up as front-end resource packs, and the executables inside carried names borrowed from software the victims already ran: adobe_32.exe, AdobeSync.exe, trueconf.exe and 1cbroker.exe. None of it opens a suspicious port or contacts a suspicious domain.
Two old bugs still doing the work in 2026
The lateral movement is where the age of this shows. In one incident the group exploited CVE-2019-0708, the RDP flaw better known as BlueKeep, and used it to create a local account and add it to the Administrators and Remote Desktop Users groups. From there it requested Kerberos tickets with an unusual flag combination (Forwardable, Proxiable and Renewable) and attempted a DCSync, replicating the domain password object to impersonate a domain controller and harvest hashes for the entire directory. A 2019 bug and a 2020 bug, chained into a full Active Directory compromise, years after both were patched.
Hunt the channel names and the tunnel DNS
Two of these steps leave cheap, reliable detections. When rdp2tcp runs, the RDP virtual channel it opens is logged with event IDs 132 and 148 in Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx, and the channel name will read rdp2tcp or an arbitrary alphanumeric string rather than a normal RemoteFX name such as cliprdr. Outbound DNS to devtunnels.ms from a server has a short list of innocent explanations. Past that, the fixes are the ones organisations have been putting off: patch Exchange, retire anything still reachable over BlueKeep, alert on netsh portproxy rules appearing on member servers, and flag replication requests from accounts that are not domain controllers.
Indicators
Tool-hosting repositories: hxxps://github[.]com/mirror-js/mirror-js and hxxps://github[.]com/browserthemes/resourcepack. File hashes: 1dcafb7f8448683281106b06dd22409a (AdobeSync.exe), 1f3034b706c78b35d8e34044e68c693a (adobe_32.exe) and 631fb131a56caf4ca0f287ed73e876ab (App_Web_Container_1.dll).
The write-up, including the detection rules Kaspersky published with it, is by Stanislav Larinsky of Kaspersky Security Services. Exchange stays the softest link here and much of it is still unpatched: 22,000 servers were exposed to a public exploit a fortnight ago. On the directory side, see our coverage of full-takeover bugs in unpatched domain controllers, and our Russia country profile for the wider picture.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.