NightEagle APT Deploys GhostContainer on Microsoft Exchange

Kaspersky's Global Emergency Response Team (GERT) has published detailed forensic telemetry unmasking recent intrusions by the advanced persistent threat group NightEagle (tracked internally as APT-Q-95). Active since at least 2023 and historically focused on targets across Asia, the espionage syndicate has pivoted its operational scope to execute complex corporate network compromises across Russia.

The threat group's updated attack lifecycle relies on a custom modular in-memory backdoor dubbed GhostContainer (Trojan.MSIL.GhostContainer.gen), injected directly into on-premise Microsoft Exchange servers. To maintain long-term, stealthy access across breached perimeters without triggering network anomaly alerts, NightEagle combines legitimate Microsoft Dev Tunnels infrastructure with custom Remote Desktop Protocol (RDP) virtual channel tunneling, ultimately executing DCSync attacks to achieve total Active Directory forest domination.

Technical Analysis

NightEagle exhibits advanced operational discipline, blending living-off-the-land utilities, open-source penetration testing modules, and proprietary memory-only execution primitives:

Initial Ingress & GhostContainer In-Memory Injection

Initial perimeter entry is established by exploiting valid corporate Virtual Private Network (VPN) credentials:

• Anonymized Egress Routing (T1133): Inbound VPN connections are routed through Russian IP nodes via Cloudflare WARP tunnels and European virtual private servers (VPS), successfully bypassing geographic IP restrictions and anomaly-based alerting.
• ASP.NET ViewState Tampering (T1505.003): Upon establishing internal network footing, the actors target Microsoft Exchange servers. NightEagle extracts ASP.NET cryptographic keys from the server configuration, generates a malicious serialized object within the __VIEWSTATE framework parameter (leveraging exploitation mechanics reminiscent of CVE-2020-0688), and loads the GhostContainer backdoor directly into the memory space of the IIS worker process (w3wp.exe).
• Modular .NET Architecture: The backdoor is constructed by combining public offensive tooling—including the Neo-reGeorg tunnel, ysoserial's GhostWebShell class, and custom proxy code across three primary classes:
  • Stub: Ingests and parses command-and-control instructions passed inside the HTTP x-owa-urlpostdata header. It evades security controls by dynamically patching memory addresses in amsi.dll (Antimalware Scan Interface) and ntdll.dll (Windows Event Tracing).
  • App_Web_843e75cf5b63: Ingests fakePath and fakePageName parameters to dynamically generate virtual routing endpoints inside the web server without creating on-disk files.
  • App_Web_8c9b251fb5b3: Implements bi-directional TCP socket forwarding and internal network proxying.

Covert Traffic Redirection & Dual-Tunneling

Once initial access is consolidated, the operators establish redundant, proxy-aware tunnels to expose internal protocols:

• Disguised Tool Repositories: NightEagle hosts weaponized tool archives on legitimate GitHub repositories masquerading as frontend libraries (mirror-js/mirror-js, browserthemes/resourcepack), dropping payloads named to mimic enterprise utilities (adobe_32.exe, AdobeSync.exe, 1cbroker.exe, trueconf.exe).
• Abuse of Microsoft Dev Tunnels (T1572): The adversaries leverage Microsoft's official development tunneling mechanism to publish internal services to the internet under *.devtunnels.ms domains. This allows the threat actors to expose internal RDP listeners (port 3389) directly to external command-and-control nodes without configuring firewall port-forwards.
• TCP Multiplexing over RDP (rdp2tcp): To tunnel arbitrary network traffic through established RDP connections, NightEagle deploys the open-source rdp2tcp server component. This establishes dynamic virtual channels visible in the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx log (recorded under Event IDs 132 and 148).
• Internal Port Proxying: The actors leverage Impacket's atexec utility to create scheduled tasks running native Windows netsh interface portproxy commands, establishing internal port forwarding (e.g. redirecting local port 443 traffic to internal SMB port 445).

Privilege Escalation & Active Directory Takeover

With persistent tunneling established, the group moves laterally to compromise centralized identity infrastructure:

• Legacy Vulnerability Exploitation (T1210): In investigated intrusions, the actors exploited CVE-2019-0708 (BlueKeep) against unpatched internal hosts, weaponizing the flaw to create rogue local administrator accounts and assign them to the Remote Desktop Users group.
• Kerberos Ticket Manipulation: The group requests Kerberos tickets with an anomalous flag combination (Forwardable, Proxiable, Renewable), facilitating long-lived ticket renewal.
• DCSync Domain Extraction (T1003.006): After securing elevated domain privileges, NightEagle invokes directory replication routines targeting the Domain-Password object to execute a DCSync attack, harvesting password hashes for all domain accounts and achieving total compromise of the victim's Active Directory domain controllers.

Attack Vector & Impact

The campaign demonstrates NightEagle's technical evolution into a high-tier advanced persistent threat:

• Abuse of Trusted Cloud Mechanisms: Leveraging legitimate cloud services (GitHub, Cloudflare WARP, and Microsoft Dev Tunnels) enables the group to blend malicious command channels with standard enterprise outbound traffic.
• Complete Domain Infrastructure Compromise: By obtaining domain controller replication authority, NightEagle gains unrestricted access to all corporate user accounts, Kerberos credentials, email mailboxes, and proprietary internal databases.
• In-Memory Evasion: Operating the GhostContainer backdoor strictly within Exchange memory spaces while actively neutralizing AMSI and ETW telemetry creates severe detection blind spots for traditional file-based antivirus solutions.

Detection & Mitigation

Defenders must implement layered detection strategies targeting in-memory injection, unauthorized developer tunnels, and Active Directory replication anomalies:

Host & Event Log Forensic Auditing

• Audit Microsoft Exchange Memory & OWA Logs: Configure EDR tools to monitor the IIS worker process (w3wp.exe) for reflective .NET assembly loading. Inspect Exchange OWA web server access logs for anomalous POST requests containing the x-owa-urlpostdata header.
• RDP Operational Channel Monitoring: Review the Windows event log Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx for Event IDs 132 (channel opened) and 148 (channel closed). Alert on virtual channel names matching rdp2tcp or unrecognized alphanumeric identifiers.
• Detect Unauthorized Dev Tunnels: Monitor endpoint network connections and DNS resolution for connections destined for *.devtunnels.ms and block the Microsoft Dev Tunnels binary (devtunnel.exe) from executing in corporate environments.
• Audit Directory Replication Events: Enable advanced audit policies for Directory Service Access (Event ID 4662) on domain controllers to detect unauthorized user accounts requesting replication rights (DS-Replication-Get-Changes-All), indicating active DCSync operations.

Enterprise Hardening Recommendations

• Enforce Strict Multi-Factor Authentication (MFA): Require phishing-resistant MFA across all corporate VPN endpoints and remote access gateways to prevent initial credential-based entry.
• Patch On-Premise Microsoft Exchange: Apply all cumulative updates (CUs) and security updates for Microsoft Exchange, ensuring that ASP.NET machine keys are rotated and protected against ViewState deserialization exploits.
• Patch Internal Windows Endpoints: Ensure all legacy Windows systems across internal network segments are patched against CVE-2019-0708 (BlueKeep) and restrict SMB/RDP access using internal micro-segmentation.