Tag: GhostContainer backdoor

NightEagle targets Russian companies

Posted on

Over the past year, Kaspersky Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (APT-Q-95). This group has been active since at least 2023 and originally focused on organizations in Asia. Kaspersky researchers have now identified Read More …

GhostContainer backdoor: Malware compromising Exchange servers of high-value organizations in Asia

Posted on

In a recent incident response (IR) case, Kaspersky researchers discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sample suggests that the Exchange server was likely compromised via a known N-day Read More …