NightEagle targets Russian companies with GhostContainer backdoor

Kaspersky has reported that its GERT experts uncovered a new campaign by the NightEagle APT group targeting Russian companies.

According to the source, the campaign features a backdoor known as GhostContainer along with tools hosted on GitHub that are used in intrusion and control operations.

The group is also exploiting vulnerabilities in Active Directory and in Remote Desktop Protocol (RDP) as part of its methods in this campaign.

These details matter to security teams because they combine a dedicated backdoor, publicly available GitHub-hosted tools, and exploitation of highly sensitive enterprise services such as Active Directory and RDP.

Readers should consult the official Securelist publication for the full details, including any CVE identifiers and the detection and containment guidance provided by the source, and should check for later updates to the report.