Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Russian commercial enterprises and critical infrastructure are facing an escalating wave of cyber intrusions, according to comprehensive telemetry and forensic reports released by cybersecurity vendor Kaspersky. Researchers have mapped out campaigns orchestrated by three distinct threat activity clusters: NightEagle, Hacking Cat, and Toy Ghouls. These groups employ a wide spectrum of tactics, techniques, and procedures (TTPs), ranging from sophisticated Advanced Persistent Threat (APT) methodologies to politically motivated hacktivism and financially driven ransomware operations.

The convergence of these distinct threat groups highlights a shifting digital battlefield in Eastern Europe, where corporate networks, government contractors, and private-sector companies are increasingly caught in the crosshairs of geopolitical conflict, cyber espionage, and digital extortion.

Anatomy of the NightEagle Campaign: Precision Espionage and Infrastructure Hijacking

At the forefront of the espionage campaigns targeting Russian entities is NightEagle, an APT group tracked alternatively as APT-Q-95, which has maintained active operations since at least 2023. Initially recognized for targeted attacks against government and high-tech sectors in Asia, NightEagle has pivoted portions of its operational focus toward Russian corporate environments, utilizing advanced persistence mechanisms and intricate lateral movement strategies.

According to Kaspersky’s technical analysis, the initial access vector primarily relies on compromised valid corporate credentials. Threat actors have leveraged these credentials to breach corporate Virtual Private Networks (VPNs). Intriguingly, forensic investigations revealed that these VPN connections frequently originated from IP addresses located within the Russian segment routed through Cloudflare WARP tunnels, alongside traffic originating from European virtual infrastructure providers designed to obscure the origin of the attack.

Once inside a network, NightEagle deploys GhostContainer, a modular backdoor engineered to provide operators with unhindered access to Microsoft Exchange Servers. GhostContainer stands out for its stealth capabilities; it masquerades as a legitimate server component to blend seamlessly into routine administrative operations, while simultaneously functioning as a traffic redirection proxy or tunnel.

The backdoor’s framework integrates open-source architecture, including components from the Neo-reGeorg tunneling tool, an exploit payload for the critical CVE-2020-0688 vulnerability, and the GhostWebShell class derived from the ysoserial utility. While the precise delivery mechanism for planting GhostContainer onto Microsoft Exchange servers remains under investigation, telemetry suggests threat actors extract server cryptographic keys from ASP.NET configurations, overwrite the VIEWSTATE framework parameter, and inject the payload directly into memory.

To expand their footprint, NightEagle operators perform lateral movement by deploying tunneling utilities that channel Remote Desktop Protocol (RDP) traffic through Microsoft dev tunnels and open-source frameworks like rdp2tcp. Privilege escalation and network traversal are further facilitated by exploiting vulnerabilities within Active Directory structures, such as CVE-2019-0708 (BlueKeep). By exploiting BlueKeep, attackers can spawn local administrative accounts and execute DCSync attacks to impersonate domain controllers. The ultimate objective of the NightEagle campaign is deep infrastructure persistence, the extraction of password hashes, the collection of long-lived Kerberos tickets, and total compromise of the victim organization’s Active Directory environment.

Hacking Cat: From Hacktivism to Destructive Ransomware and Wiper Operations

Operating in parallel with espionage-focused APTs, pro-Ukrainian hacktivist collective Hacking Cat has undergone a significant operational evolution. Initially known for website defacements and public data breaches since February 2024, the group has transitioned into deploying destructive ransomware and wiper malware targeting Russian commercial enterprises.

Kaspersky’s findings indicate that Hacking Cat frequently collaborates with other ideologically aligned factions, including the Cyber Anarchy Squad and the Ukrainian Cyber Alliance. This cooperative ecosystem complicates attribution, as multiple groups frequently share custom toolsets and leverage similar multi-stage infection chains. This cross-pollination suggests the existence of a centralized developer cell or shared resource pool supplying modular toolkits to disparate hacktivist factions.

Hacking Cat’s operational playbook relies on exploiting known vulnerabilities in Microsoft Exchange servers, specifically CVE-2021-26855 and CVE-2026-42897. Through these exploits, the group delivers Gorilla RAT, a Go-based remote access trojan capable of establishing command-and-control (C2) communication, executing arbitrary system commands, gathering deep system intelligence, and opening custom TCP tunnels within the internal network.

In addition to espionage and reconnaissance tools, Hacking Cat has deployed multiple iterations of a ransomware family designated as Monkey. Written across diverse programming languages including Rust, .NET, C++, and Golang, Monkey ransomware targets Windows, Linux, and VMware ESXi environments. The malware systematically terminates non-essential services and dismantles system recovery mechanisms prior to initiating file encryption.

Notably, certain variants of the Rust-based Monkey ransomware utilize ChaCha20-Poly1305 encryption alongside a 32-byte key. In specific instances, investigators noted that the malware omitted key storage routines—effectively transforming the ransomware into a destructive wiper while still leaving behind a ransom note. Conversely, other variants stored the key without providing external contact channels for ransom negotiations. Analysts also identified operational oversights, such as the inclusion of shadow volume copy deletion routines in Golang variants targeting Linux and ESXi environments where shadow copies do not exist, pointing toward the potential integration of artificial intelligence tools in drafting the codebase.

Furthermore, collaborative efforts have seen Hacking Cat deploy the Clearwater ransomware via automated batch scripts under a Ransomware-as-a-Service (RaaS) model, alongside Nemo Wiper, a destructive utility that overwrites corporate files with random byte sequences and clogs free disk space with randomized .lock files.

Despite these detailed technical associations, Hacking Cat publicly disputed aspects of Kaspersky’s attribution via its official Telegram channel. The group claimed ownership of select reconnaissance tools but disavowed the ransomware lockers, accusing cybersecurity researchers of misattributing unrelated toolsets.

Toy Ghouls: Transitioning to Custom Backdoors and Unconventional C2 Channels

Rounding out the trio of threat actor clusters is Toy Ghouls (also tracked as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group active since 2025. Initially relying on leaked builders for established ransomware variants like Babuk and LockBit, followed by their custom GenieLocker ransomware, Toy Ghouls has shifted toward bespoke backdoor deployments to maintain persistent access within target networks.

Detected in mid-2026, the group’s primary new malware—designated as Bird Agent—appears in distinct variants utilizing unconventional command-and-control communication channels. Toy Ghouls operators utilize Windows Remote Management (WinRM) alongside open-source utilities like Evil-WinRM and WinRM-fs to deliver the backdoors and associated configuration files to compromised enterprise endpoints.

The Bird Agent backdoor operates either through interactive command-line sessions or as an installed Windows service. Upon execution, the malware searches for an encrypted configuration file ("config.toml"). To tie the deployment directly to the target environment, the configuration is partially encrypted using a cryptographic key derived from the victim machine’s MachineGuid stored in the Windows Registry.

Depending on the specific variant, Bird Agent utilizes either the HiveMQ MQTT broker protocol or the Element messenger platform (leveraging internal Matrix room identifiers and access tokens) to establish C2 communication. By leveraging MQTT brokers and Matrix-based messaging apps, the threat actors bypass traditional web traffic monitors, routing execution commands through PowerShell or the Windows command-line interface while returning operational results to the remote operators. Kaspersky researchers noted that this departure from standard open-source utility usage toward customized, multi-channel protocols underscores an industry-wide trend of increasing sophistication aimed at extending dwell times and evading automated detection systems.

Broader Implications for Enterprise Security and Digital Resilience

The coordinated campaigns mounted by NightEagle, Hacking Cat, and Toy Ghouls illustrate a rapidly maturing threat landscape directed at commercial organizations in Russia. The simultaneous employment of state-sponsored espionage techniques, ideological destructive operations, and financial extortion highlights the multifaceted nature of modern cyber conflicts.

For enterprise defenders, these campaigns reinforce the critical necessity of rigorous patch management—particularly concerning Microsoft Exchange servers and Active Directory environments—alongside strict validation of VPN authentication pathways. As threat actors increasingly adopt living-off-the-land techniques, leverage legitimate administrative utilities like WinRM, and utilize encrypted messaging protocols for command-and-control operations, traditional signature-based security defenses prove insufficient. Organizations must transition toward behavior-based anomaly detection, continuous log auditing, and comprehensive multi-factor authentication enforcement to safeguard core infrastructure against multi-vector intrusion attempts.