Russian organizations are under growing cyberattack from three major threat groups—NightEagle, Hacking Cat, and Toy Ghouls—that are using backdoors, ransomware, and wipers to breach corporate systems. A recent analysis from cybersecurity firm Kaspersky reveals these actors, active since 2023–2025 depending on the group, are employing increasingly complex tools and tactics to infiltrate, persist, and damage networks.
NightEagle’s Advanced Backdoor & Lateral Movement Tactics
NightEagle (also known as APT-Q-95) has been active since at least 2023 and has targeted Russian enterprises using compromised credentials to access corporate VPNs. These connections often originate via Russian IPs linked to Cloudflare WARP tunnels or European virtual infrastructure providers. Once inside, NightEagle deploys a modular backdoor known as GhostContainer against Microsoft Exchange Servers, enabling functions like code execution, file operations, and loading additional modules.
To avoid detection, this malware impersonates typical server components, acting as both a backdoor and a network tunnel. It integrates open-source tools like Neo-ReGeorg, the exploit for CVE-2020-0688, and GhostWebShell from ysoserial. Delivery methods remain uncertain, but investigators believe attackers exfiltrate cryptographic keys from ASP.NET configurations and overwrite Exchange Server’s VIEWSTATE parameters to inject payloads in memory. For lateral movement, NightEagle has used Microsoft dev tunnels, rdp2tcp, and exploited vulnerabilities in Active Directory—most prominently the BlueKeep exploit—to gain elevated access and even launch DCSync-style attacks to impersonate domain controllers.
Hacking Cat’s Shift to Destructive Malware
Hacking Cat, a pro-Ukrainian hacktivist collective known for website defacements and data leaks since early 2024, has recently adopted more destructive tools. It now deploys Gorilla RAT via vulnerabilities in Exchange servers (including CVE-2021-26855 and a newer CVE-2026-42897), enabling remote access and control over infected systems—uploading files, executing commands, tunneling traffic.
In tandem, Hacking Cat’s ransomware arsenal—known as Monkey—has expanded with variants written in Rust, .NET, C++, and Go targeting Windows, Linux, and VMware ESXi. The malware often disables recovery tools, purges backup files, alters registry settings, and sometimes even functions as a wiper when it intentionally omits key storage. Other operations involve a wiper called Nemo that overwrites files with random bytes and fills drives with spam files. Some attacks are conducted via collaborations with groups like Cyber Anarchy Squad and Ukrainian Cyber Alliance, sharing tools and operating under the ransomware-as-a-service model.
Toy Ghouls’ Custom Backdoor & Independent Tooling
Toy Ghouls—also referred to as Bearlyfy, Laboo.boo, or Feral Wolf—has evolved from employing borrowed ransomware frameworks like Babuk and LockBit to creating its own tools. Since early 2025 the financially motivated group has introduced its GenieLocker ransomware, and in mid-2026 began deploying a custom backdoor dubbed Bird Agent. Two variants have been observed: one using the HiveMQ MQTT broker for command-and-control (C2), and another using Element (a Matrix-based encrypted messenger) for C2.
The group delivers Bird Agent through Windows Remote Management, leveraging tools like Evil-WinRM and WinRM-fs. Once installed, it may instantiate as a Windows service. It reads a configuration file—either local or specified via command-line flags—that is partially encrypted using the target machine’s MachineGuid, binding execution to that system. Depending on variant, it collects system info, listens for commands from the HiveMQ or Element channels, executes them via PowerShell or CLI, and returns output to the C2 infrastructure.
These three threat clusters exemplify a troubling trend in cyberwarfare: toolkits are becoming more modular and custom, combining remote access trojans, wipers, and ransomware with seamless persistence and evasion. What to watch next is how defenders respond—patching vulnerable Exchange instances, securing Active Directory, monitoring dev tunnels—and whether more groups will adopt Bird Agent-style backdoors or shared malware libraries. The stakes are rising, with Russian infrastructure squarely in the crosshairs.
