Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
NightEagle Deploys GhostContainer Backdoor on Microsoft Exchange Servers in Russian Attacks
Threat Actors
Malware Families
Excerpt
Kaspersky’s Global Emergency Response Team (GERT) has uncovered a new campaign by the NightEagle APT group, also tracked as APT-Q-95, deploying a stealthy backdoor called GhostContainer against Microsoft Exchange servers belonging to Russian organizations. The group, active since at least 2023, originally focused on targets in Asia but has now expanded its geographic scope to Russian businesses, signaling a broadening threat surface for enterprise mail infrastructure.…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2020-0688 | Medium | Score 57/100 | First seen |
| CVE | CVE-2019-0708 | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…