NightEagle (APT-Q-95): How a Chinese-Linked Group Expanded to Russia — GhostContainer, Dev Tunnels, and Supply Chain Credential Theft

1. Who Is NightEagle?

NightEagle (also tracked as APT-Q-95) is an advanced persistent threat group active since at least 2023. According to Kaspersky's Global Emergency Response Team (GERT), the group originally focused on intelligence gathering against organizations in Asia, employing credential theft and social engineering as primary operational tactics.

Starting in mid-2025, Kaspersky GERT observed a significant geographic shift: NightEagle began actively targeting businesses in Russia. The group's operations expanded from its original Asian focus to include Russian enterprises, indicating either a strategic pivot by the threat actor or a broadening of its intelligence collection mandate.

The Record separately reported on Kaspersky's findings, noting that over the past year, the security firm investigated multiple incidents involving the group at Russian businesses. The timing suggests coordinated campaigns rather than opportunistic targeting.

2. Initial Access: The Cloudflare WARP Vector

In most incidents Kaspersky investigated, the attackers gained initial access through compromised valid credentials to corporate VPNs. This is a classic "living off the land" approach — no exploitation of VPN vulnerabilities, just credential abuse against exposed remote access portals.

What distinguishes NightEagle's approach is the source of their VPN connections. Kaspersky identified that VPN connections originated from:

• IP addresses in the Russian internet segment linked to Cloudflare WARP tunnels
• IP addresses associated with European virtual infrastructure providers

The use of Cloudflare WARP is particularly notable. WARP is Cloudflare's consumer VPN service, not designed for anonymity — but by routing through WARP nodes inside the target's home country, the attackers made their connections appear as domestic traffic. This bypasses geographic IP filtering that many Russian organizations apply as a basic security measure.

3. GhostContainer: The Exchange Server Backdoor

Once positioned inside the target network, NightEagle operators deploy the GhostContainer backdoor on Microsoft Exchange servers. GhostContainer is a .NET assembly incorporating components from several open-source projects:

• Neo-reGeorg tunnel — a well-known HTTP tunnel tool
• CVE-2020-0688 exploit — the decade-old Exchange privilege escalation vulnerability
• GhostWebShell class from the ysoserial utility

3.1 GhostContainer Architecture

GhostContainer is a .NET assembly containing three classes:

• Stub — processes C2 commands delivered via x-owa-urlpostdata HTTP headers. Implements evasion against AMSI (Antimalware Scan Interface) and Windows Event Log by overwriting addresses in amsi.dll and ntdll.dll
• App_Web_843e75cf5b63 — accepts fakePath and fakePageName parameters, creates virtual paths redirecting requests to the third class
• App_Web_8c9b251fb5b3 — implements network traffic redirection (proxying) and socket forwarding

Kaspersky products detect GhostContainer as Trojan.MSIL.GhostContainer.gen.

3.2 VIEWSTATE Injection Technique

Kaspersky assesses with high confidence that the backdoor is delivered through a technique they previously documented: extracting cryptographic keys used by Microsoft Exchange from ASP.NET configuration, overwriting the VIEWSTATE framework parameter, and injecting a payload that launches GhostContainer in memory — leaving minimal forensic artifacts.

This VIEWSTATE manipulation technique is particularly dangerous because it operates within legitimate Exchange framework components, making file-based antivirus scanning largely ineffective.

3.3 AMSI and Event Log Evasion

GhostContainer's Stub class includes specific evasion capabilities:

• AMSI bypass — overwrites function addresses in amsi.dll to prevent runtime script scanning
• Event Log suppression — patches ntdll.dll to prevent Event Tracing for Windows (ETW) from recording malicious activity

This dual evasion technique means the backdoor can execute PowerShell scripts (for lateral movement) and .NET payloads (for persistence) without triggering either AMSI or Windows Event Log — two of the most common detection mechanisms in enterprise environments.

4. Lateral Movement: Traffic Redirection via Microsoft Dev Tunnels

After establishing the Exchange foothold, NightEagle operators leverage RDP for lateral movement within the internal network. To expose RDP services from compromised hosts, they use a combination of two tunneling techniques.

4.1 Microsoft Dev Tunnels (Legitimate Tool Abuse)

Microsoft Dev Tunnels is a legitimate mechanism intended for developers to expose local web services via public URLs on *.devtunnels.ms domains. NightEagle repurposes this for malicious tunneling — exposing port 3389 (RDP) on compromised hosts through official Microsoft infrastructure.

Because the traffic flows through devtunnels.ms domains, and because Microsoft dev tunnels are a legitimate development tool, outbound connections to these domains rarely trigger network monitoring alerts in enterprise environments. The attackers effectively hide inside Microsoft's own infrastructure.

4.2 Fake GitHub Repositories Hosting Tools

NightEagle hosts its tunneling tools on GitHub repositories disguised as legitimate projects:

https://github[.]com/mirror-js/mirror-js/refs/heads/main/js/js-webpack.zip
https://github[.]com/mirror-js/mirror-js/refs/heads/main/js/jsonp-pack.zip
https://github[.]com/browserthemes/resourcepack/releases/download/main/resource-pack.zip
    

The repository names (mirror-js, browserthemes/resourcepack) mimic npm packages and browser theme resources respectively — repositories that developers commonly trust and download without scrutiny.

4.3 Masqueraded Binary Names

Once extracted, the tools inside the archives are renamed to mimic legitimate software common in Russian enterprise environments:

• adobe_32.exe
• AdobeSync.exe
• trueconf.exe (TrueConf is a popular Russian video conferencing platform)
• 1cbroker.exe (1C is the dominant enterprise ERP platform in Russia)
• 1c-office-plugin.exe
• trueconf-broker.exe

The choice of names is clearly tailored to Russian targets — TrueConf and 1C are standard software packages in Russian organizations. This localization suggests the group has specific intelligence on its victim environments and invests in operational security to evade process-level monitoring.

5. MITRE ATT&CK Mapping

6. Indicators of Compromise

Based on Kaspersky's investigation and supplementary open-source analysis, defenders should monitor for the following indicators:

Network Indicators

• Outbound connections to *.devtunnels.ms domains from non-developer workstations
• VPN connections from domestic IP ranges that route through Cloudflare WARP (identifiable by Cloudflare's IP ranges)
• HTTP POST requests to Exchange OWA with anomalous x-owa-urlpostdata headers
• Connections to GitHub repositories under mirror-js or browserthemes from Exchange servers

Host Indicators

• Unusual processes with names adobe_32.exe, AdobeSync.exe, trueconf.exe, 1cbroker.exe on servers without the corresponding legitimate software installed
• AMSIScan buffer modifications (check amsi.dll integrity)
• Exchange VIEWSTATE parameters larger or structured differently than baseline
• .NET assemblies loaded into w3wp.exe (IIS worker process) with unexpected class names

7. Attribution Analysis

Kaspersky tracks the group as APT-Q-95 without explicitly attributing it to any specific state. However, the operational patterns — intelligence-gathering objective, credential-centric TTPs, focus on high-tech sectors, and expansion from Asia to Russia — align with patterns historically associated with Chinese-origin threat groups.

The Record's reporting notes that the group's expansion to Russian targets coincided with increased geopolitical tensions, though neither Kaspersky nor The Record makes a formal attribution statement. The use of common Chinese-nexus tools (ysoserial, CVE-2020-0688 exploitation, Neo-reGeorg tunneling) is consistent but not individually distinctive — these tools are used by threat groups globally.

What is distinctive is the operational security investment: the tailored binary names for Russian software ecosystems (TrueConf, 1C), the use of Cloudflare WARP for geographic IP masking, and the abuse of Microsoft dev tunnels for C2 infrastructure. These indicate a group with dedicated operational security resources, consistent with a state-affiliated threat actor.

8. Defensive Recommendations

Based on the observed TTPs, organizations — particularly those in Russia or with Russian business operations — should implement the following:

1. Monitor dev tunnels usage. Microsoft dev tunnels traffic to *.devtunnels.ms from non-developer workstations should generate immediate alerts. Implement a blocklist for these domains on non-development systems.
2. Enforce VPN credential hygiene. Given NightEagle's reliance on compromised credentials, implement mandatory MFA for all VPN access, monitor for credential stuffing patterns, and rotate VPN credentials on a regular cadence.
3. Harden Exchange servers. Apply the CVE-2020-0688 patch if not already deployed. Monitor Exchange VIEWSTATE parameters for anomalous sizes. Enable AMSI for IIS worker processes.
4. Audit GitHub access from internal systems. Monitor downloads from repositories matching suspicious naming patterns (mirror-js, browserthemes-style names).
5. Deploy behavioral detection. Given GhostContainer's AMSI/ETW bypass, rely on behavioral detection rather than signature-based AV. Monitor for unusual child processes spawned by w3wp.exe, particularly those that launch executables from user-writable directories.

Sources

• Kaspersky Securelist — NightEagle targets Russian companies
• The Record — Hacking group NightEagle targeting China's high-tech sector expands operations to Russia