Three Threat Groups Target Russian Enterprises With Backdoors and Ransomware

Cybersecurity researchers have identified three threat activity clusters targeting organizations in Russia: NightEagle, Hacking Cat, and Toy Ghouls.

According to multiple reports from Kaspersky, the groups are using a combination of stolen credentials, vulnerable enterprise systems, remote-access tools, custom backdoors, ransomware, and destructive malware.

NightEagle Uses Stolen Credentials and GhostContainer

NightEagle, also tracked as APT-Q-95, has been active since at least 2023. Recent attacks against Russian organizations have introduced new techniques for maintaining access and moving through corporate networks.

In many incidents, the attackers used compromised credentials to access corporate VPNs. Connections were observed from Russian IP addresses associated with Cloudflare WARP tunnels and from infrastructure providers in Europe.

GhostContainer Backdoor

The attackers have deployed GhostContainer, a modular backdoor capable of providing extensive access to Microsoft Exchange Server environments.

The malware can:

  • Execute arbitrary code.
  • Perform file operations.
  • Load additional modules.
  • Redirect network traffic.
  • Establish tunnels for remote access.

GhostContainer disguises itself as a legitimate server component to make detection more difficult.

Kaspersky said the malware incorporates code and components from several publicly available projects, including Neo-reGeorg, an exploit for CVE-2020-0688, and the GhostWebShell class from the ysoserial utility.

The exact method used to install GhostContainer on Exchange servers remains unclear. Researchers believe the attackers may have extracted cryptographic keys from ASP.NET configuration files and abused the VIEWSTATE mechanism to inject a payload that launches the backdoor directly in memory.

NightEagle Moves Through Internal Networks

NightEagle has also used tunneling tools to move between systems.

The attackers used Microsoft Dev Tunnels and the open-source rdp2tcp utility to redirect network traffic through Remote Desktop Protocol connections.

Kaspersky also observed exploitation of vulnerabilities affecting Active Directory environments.

One technique involved CVE-2019-0708, also known as BlueKeep. The attackers used the vulnerability to create a local account and add it to the Administrators and Remote Desktop Users groups.

The group was also observed attempting DCSync attacks, which can allow attackers to obtain password hashes for domain accounts by impersonating a domain controller.

The broader objective appears to be maintaining long-term access, obtaining domain credentials, using Kerberos tickets to access internal resources, and eventually compromising domain controllers and the wider Active Directory environment.

Hacking Cat Deploys Gorilla RAT and Monkey Ransomware

The second threat cluster identified by Kaspersky is Hacking Cat, a pro-Ukrainian hacktivist group that has conducted website defacements and data breaches since February 2024.

More recently, the group has reportedly shifted toward encryption and destructive attacks.

Kaspersky said Hacking Cat has worked with other hacktivist groups, including Cyber Anarchy Squad and the Ukrainian Cyber Alliance, making attribution of individual tools more difficult.

Gorilla RAT

Hacking Cat has exploited vulnerabilities in Microsoft Exchange servers, including CVE-2021-26855 and CVE-2026-42897, to deliver a Go-based remote access trojan known as Gorilla RAT.

The malware can establish a connection with a remote server and allow attackers to:

  • Execute commands.
  • Enumerate running processes.
  • Collect system information.
  • Upload and download files.
  • Create and close TCP tunnels.

The tunneling capability can provide attackers with access to internal network resources.

Monkey Ransomware

The group has also deployed multiple variants of Monkey ransomware.

The ransomware has been developed in Rust, .NET, C++, and Golang, with variants targeting Windows, Linux, and VMware ESXi systems.

The earliest known Monkey ransomware sample dates back to late summer 2025.

Different versions can disable security and recovery mechanisms before encrypting files.

The Rust variant generates a 32-byte encryption key and uses ChaCha20-Poly1305 to encrypt files. Some versions do not store the encryption key, potentially making them function more like wipers while still displaying ransom notes.

.NET Variant

The .NET version uses AES-256-CBC encryption and can:

  • Generate and transmit an encryption key to a command-and-control server.
  • Attempt privilege escalation.
  • Disable Windows recovery mechanisms.
  • Steal Microsoft Outlook credentials.
  • Delete backup-related files.
  • Remove itself after execution.

C++ Variant

The C++ version adds several persistence and defense-evasion capabilities.

It can establish persistence through scheduled tasks or a RunOnce registry key and can:

  • Clear system logs.
  • Disable logging.
  • Delete PowerShell command history.
  • Clear Windows Command Prompt history.
  • Attempt to bypass AMSI.
  • Disable Event Tracing for Windows.
  • Add Microsoft Defender exclusions.
  • Modify registry settings.
  • Disable Task Manager and Command Prompt.
  • Disable Volume Shadow Copy Service.
  • Disrupt backup and recovery mechanisms.

Golang Variant

The Golang version primarily targets Linux and VMware ESXi systems.

It can establish persistence through crontab, disable security mechanisms such as SELinux and AppArmor, and attempt to remove volume shadow copies.

Kaspersky noted that some functionality appears poorly suited to Linux and ESXi environments. The company suggested this could indicate careless development and theorized that AI may have been involved in developing parts of the toolkit.

ClearWater and Nemo Wiper

Hacking Cat has also been observed working with Cyber Anarchy Squad to deploy another ransomware family known as ClearWater through a batch script.

ClearWater is assessed by Kaspersky as being distributed through a ransomware-as-a-service model to pro-Ukrainian hacktivist groups.

In another operation involving the Ukrainian Cyber Alliance, the attackers deployed Nemo Wiper.

The wiper overwrites files with random data and fills available disk space with files containing random alphanumeric names and the .lock extension.

Kaspersky said the use of similar self-developed tools across different hacktivist groups could indicate a shared developer or a small group of developers maintaining and modifying the malware.

Hacking Cat disputed some of Kaspersky's attribution following publication of the report, stating that while some of the tools were theirs, the ransomware lockers were not.

Toy Ghouls Deploys Custom Bird Agent Backdoor

The third threat cluster, Toy Ghouls, is also known as Bearlyfy, Laboo.boo, and Feral Wolf.

The financially motivated group has been active since 2025 and previously used leaked Babuk and LockBit ransomware builders before moving to its own GenieLocker ransomware.

Kaspersky has now identified a custom backdoor used by the group.

The backdoor, first detected in July 2026, has two known variants:

  • mqtt-bird-agent 0.1.0, which uses the HiveMQ MQTT broker for command and control.
  • matrix-bird-agent 0.1.0, which uses the Matrix-based Element messenger for command and control.

WinRM Used to Deliver the Backdoor

Toy Ghouls uses Windows Remote Management (WinRM) to deploy the backdoors and their configuration files to compromised systems.

The group has used open-source utilities such as Evil-WinRM and WinRM-fs for this activity.

The Bird Agent malware can operate inside an interactive command-line session or establish persistence as a Windows service.

After launching, it searches for a config.toml configuration file in its current directory. Operators can also specify the configuration file using the -c or --config option.

The configuration is partially encrypted using a key derived from the victim machine's MachineGuid value stored in the Windows Registry. This binds the configuration to a specific system.

If the malware cannot decrypt the configuration during a later execution, it stops running.

HiveMQ and Element Used for Command and Control

The MQTT version communicates through a HiveMQ MQTT broker, while the second version uses an Element room on the Matrix network.

The configuration can contain a HiveMQ cluster identifier or an Element room identifier and access token.

Once connected, the malware collects system information and retrieves commands from the command-and-control infrastructure.

The HiveMQ variant can execute received commands through hidden PowerShell sessions and send the results back to the attacker.

The Element variant performs similar operations but uses the Windows command-line interface to execute commands.

Kaspersky said the use of HiveMQ and Matrix-based Element provides unconventional command-and-control channels that can make malicious traffic harder to identify.

The move from publicly available ransomware builders and tools toward custom-built malware indicates a change in Toy Ghouls' tooling and attack infrastructure.