OTX Threat: NightEagle targets Russian companies

The NightEagle APT group (APT-Q-95), active since 2023 and initially targeting Asian organizations, has expanded operations to Russian enterprises. Attackers gain initial access through compromised VPN credentials originating from Cloudflare WARP tunnels and European infrastructure providers. They deploy the GhostContainer backdoor on Microsoft Exchange servers, exploiting CVE-2020-0688 and incorp CVEs: CVE-2019-0708, CVE-2020-0688