NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and attempts DCSync against Active Directory
Kaspersky: an APT group that abused Microsoft's own developer-tunnel feature to expose RDP outward, then attempted DCSync once it held a privileged account
Analysis
Kaspersky's Global Emergency Response Team documents a NightEagle (also tracked as APT-Q-95) campaign, active since at least 2023 and previously focused on Asian targets, now confirmed against organizations in Russia (Kaspersky Securelist, 2026-09-16). In most incidents, initial access used compromised VPN credentials, with connections originating from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from European VPS ranges. On Microsoft Exchange servers the group deploys the GhostContainer backdoor, a .NET assembly that incorporates the Neo-reGeorg tunnel, an exploit component for CVE-2020-0688, and the GhostWebShell class from the ysoserial utility; Kaspersky could not determine how the backdoor reached the servers but assesses with high confidence that delivery reused a technique it had already documented: extracting Exchange's own ASP.NET machine keys, then overwriting the VIEWSTATE framework parameter and injecting a payload into it to launch the backdoor in memory. Once running, the backdoor evades detection by patching addresses in amsi.dll and ntdll.dll, blinding both the Antimalware Scan Interface and Windows Event Logging.
For network access, NightEagle abuses Microsoft's own legitimate dev-tunnels feature (*.devtunnels.ms), a service meant to publish local developer web services to the internet, to expose port 3389 (RDP) outward on the compromised host, then layers rdp2tcp, a public RDP-virtual-channel TCP tunneling tool, inside that RDP session, a combination Kaspersky states lets the group maintain network access using legitimate services, without opening any additional suspicious port. Payload archives staged on GitHub contain files named to mimic legitimate Adobe, 1C and TrueConf software, unrelated to the archive names (Kaspersky Securelist, 2026-09-16). For lateral movement and privilege escalation, NightEagle exploited CVE-2019-0708 (BlueKeep) in one incident to create and elevate a local account into the Administrators and Remote Desktop Users groups, used Impacket's atexec to set scheduled netsh portproxy rules for internal port forwarding, and requested Kerberos tickets carrying a non-standard Forwardable/Proxiable/Renewable flag combination. After obtaining an account with sufficient privileges, the group attempted DCSync, replicating the Domain-Password object from Active Directory by impersonating the domain controller (Kaspersky Securelist, 2026-09-16).
Triage: Microsoft dev-tunnels traffic to *.devtunnels.ms is legitimate on developer workstations running Visual Studio or the Dev Tunnels CLI; the discriminator is the host class: a production server, domain controller, or non-developer endpoint establishing an outbound dev-tunnels connection has no legitimate reason to do so.
Cited evidence
We have now identified attacks by the group targeting businesses in Russia.
This is a legitimate Microsoft mechanism that allows local web services to be published for internet access on ..devtunnels.ms domains. The attackers used this tunneling capability to expose port 3389 (RDP) on the compromised system.
In one incident, they exploited a well-known RDP implementation vulnerability, CVE-2019-0708 (BlueKeep). They used the vulnerable mechanism to create a local account on the system and add it to the Administrators and Remote Desktop Users groups.
The attackers also requested Kerberos tickets with a non-standard combination of flags (Forwardable, Proxiable, Renewable) and attempted to replicate the Domain-Password object from the Active Directory database to impersonate the domain controller (a technique known as DCSync) after obtaining an account with sufficient privileges.
Updates1
Kaspersky reports that NightEagle attempted DCSync, replicating the Domain-Password object after it obtained a sufficiently privileged account, and exploited BlueKeep in one incident to create a local administrator (Kaspersky Securelist, 2026-09-16). It does not describe BlueKeep leading to the DCSync attempt. For CVE-2020-0688 it says only that the GhostContainer backdoor carries an exploit for it, and it could not determine how the backdoor was delivered (Kaspersky Securelist, 2026-09-16).
Sources2
Revision history
- Published 2026-09-21T0410Z-intel
- Correction 2026-09-30T0639Z-audit
The structured CVE data did not mark CVE-2020-0688 as exploited although the body describes NightEagle's GhostContainer carrying an exploit for it, and neither CVE carried its long-standing CISA KEV listing. Both are now marked exploited and KEV-listed. The priority moves from high to notable because the documented targeting is Russian and Asian organizations and both flaws are years-old patches. The title, headline and summary no longer describe a BlueKeep-to-DCSync chain or a completed credential dump: Kaspersky reports BlueKeep in one incident and a DCSync attempt after a privileged account was obtained, and says only that the backdoor carries a CVE-2020-0688 exploit. Scheduled-task creation through atexec is remapped to Scheduled Task, payload file names are removed, and the KEV listing is cited in the text.
Changed: cves priority sources title headline summary techniques body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.