In short: On September 18, 2026, Kaspersky reported the first attacks by Chinese APT group NightEagle (APT-Q-95) on Russian manufacturing and construction companies. Entry was gained through compromised corporate VPN credentials, after which attackers deployed the GhostContainer backdoor in Microsoft Exchange server RAM. The campaign marks NightEagle's first operation outside Asia and demonstrates why VPN access without multi-factor authentication remains a critical attack vector.
Who Is NightEagle: First Attacks on Russia
NightEagle (APT-Q-95) has been active since 2023. Until September 2026, the group primarily targeted Chinese organizations; the Russian campaign marks its first operation outside Asia. Kaspersky attributed the campaign to NightEagle based on technical indicators and behavioral patterns. Researcher Stanislav Larinsky stated that "the NightEagle group is expanding its attack geography and developing new techniques for infrastructure penetration." APT tools and playbooks refined against one region are increasingly repurposed for new geographies — making groups like NightEagle a systemic threat rather than a regional one. For broader coverage of corporate threats, see the LiMP VPN security blog.
Attack Chain: From VPN Credentials to Full Domain Compromise
The attack began with compromised corporate VPN accounts — obtained via phishing, third-party data leaks, weak password exploitation, or dark-web marketplaces. Once inside the corporate perimeter, attackers deployed the GhostContainer backdoor (detected as Trojan.MSIL.GhostContainer.gen) on Microsoft Exchange servers using _VIEWSTATE parameter manipulation — executing malicious code directly in server RAM without writing to disk.
Post-compromise activity included lateral movement via RDP, exploitation of the BlueKeep vulnerability, DCSync attacks to extract all domain password hashes, and Kerberoasting to harvest service account credentials. The ultimate goal was full domain infrastructure control.
Living Off the Land: GitHub and Microsoft Dev Tunnels as Cover
A defining feature of the campaign was its reliance on legitimate infrastructure to mask malicious activity. Attackers stored tools in GitHub repositories and used Microsoft Dev Tunnels for encrypted C2 communications. The rdp2tcp utility routed traffic through RDP sessions.
This "living off the land" approach means attacker traffic blends with legitimate business activity, making detection harder. As Kaspersky observed, "GitHub, RDP, and Microsoft services can become cover for cyberespionage." A trusted-service allowlist is necessary but insufficient: if an attacker has a foothold, legitimate platforms become attack infrastructure.
What This Means for Your Organization
The NightEagle campaign illustrates a persistent reality: corporate VPN without strong authentication is an entry point, not a barrier. When VPN credentials are stolen, attackers gain the same network access as legitimate employees — with full lateral movement potential. Companies most at risk are those that do not enforce MFA on VPN access, have unpatched Exchange and RDP servers, and lack monitoring for anomalous domain activity. See LiMP VPN security features for how encrypted traffic protection reduces exposure when accessing corporate resources remotely.
How to Protect Your Infrastructure
Based on Kaspersky's recommendations:
- Enforce MFA everywhere: VPN, Exchange, RDP and admin panels — a second factor stops attackers even when passwords are compromised.
- Patch management: BlueKeep dates to 2019 but remains actively exploited; prioritize Exchange and internet-facing RDP servers.
- Anomaly detection: Configure SIEM/EDR to flag DCSync activity, Kerberoasting attempts, unusual Dev Tunnels connections and bulk AD queries.
- Network segmentation: Limit lateral movement to contain the blast radius of any single compromised node.
- VPN access audits: Regularly review who has remote access, revoke unused credentials and enforce geography-based login restrictions.