NightEagle APT Targets Russian Companies with GhostContainer Backdoor

Kaspersky's Global Emergency Response Team (GERT) has been investigating incidents involving the NightEagle group, also known as APT-Q-95, which has been active since at least 2023. Initially targeting organizations in Asia, the group has now expanded its operations to include businesses in Russia. This article delves into both known and newly identified tools that NightEagle has utilized in its latest campaign.

In many of the incidents examined, attackers gained access to corporate VPNs using compromised valid credentials. The VPN connections were traced back to IP addresses in Russia linked to Cloudflare WARP tunnels, as well as to European virtual infrastructure providers.

During the initial access phase and throughout the attack, the attackers deployed the GhostContainer backdoor on Microsoft Exchange servers. This backdoor integrates components from various open-source projects, including the Neo-reGeorg tunnel and an exploit for the CVE-2020-0688 vulnerability, as well as the GhostWebShell class from the ysoserial utility. All these components are publicly accessible on GitHub.

While the exact delivery method of the backdoor to Microsoft Exchange servers remains unclear, it is believed that the attackers used a familiar technique: extracting cryptographic keys from the ASP.NET configuration, overwriting the VIEWSTATE framework parameter, and injecting a payload that launched the GhostContainer backdoor in memory.

The GhostContainer backdoor is a .NET assembly that includes three classes responsible for its core functionality. Kaspersky products identify this backdoor as Trojan.MSIL.GhostContainer.gen.

Once the attackers achieve sufficient privileges, they utilize RDP to move laterally within the internal network. They download and execute tools for tunneling and redirecting network traffic, often using GitHub repositories to host their tools under names that appear legitimate.

In the incidents investigated, two tools were identified that the attackers combined for traffic tunneling. When virtual channels are opened and closed, corresponding events are logged in the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx Windows log, detailing the names of the channels used by the RemoteFX module.

Techniques for Gaining System Access

The attackers also employed the atexec utility from the Impacket toolkit to create scheduled tasks on target systems, enabling network port forwarding through standard Windows functionality. To gain elevated privileges and move laterally, NightEagle exploited various vulnerabilities in Active Directory, using established tunnels to connect to internal systems.

In one instance, they exploited the CVE-2019-0708 (BlueKeep) vulnerability to create a local account on the system and add it to the Administrators and Remote Desktop Users groups. This exploit allowed them to establish persistence within the infrastructure, obtain password hashes for domain accounts, and use long-lived Kerberos tickets to access target resources.

As NightEagle updates its methods and adopts new techniques for persistence and lateral movement, timely detection of anomalies and a comprehensive approach to infrastructure protection can significantly impede their efforts. The group relies on known legitimate tools and infrastructure vulnerabilities, making well-configured monitoring essential for detecting their presence on networks.

Kaspersky solutions effectively identify the malicious activities described at various stages of the attack. The Kaspersky Threat Attribution Engine (KTAE) assists SOC analysts in determining which APT groups can be attributed to specific malware. The GhostContainer backdoor has shown similarities to previously analyzed samples linked to the NightEagle group.

Final Brief

Detection scenarios for these types of attacks extend beyond file analysis. Deploying a backdoor on a target host generates numerous characteristic artifacts, allowing Kaspersky Endpoint Detection and Response Expert to alert users to anomalies in the infrastructure.

Kaspersky Anti Targeted Attack (KATA) detects this malicious activity in network traffic, including attempts to exploit the CVE-2019-0708 vulnerability. KATA also identifies other actions taken by NightEagle in network traffic, enhancing the ability to monitor and respond to these threats.