NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers

NightEagle, an espionage-focused threat group also tracked as APT-Q-95, has expanded its operations from Asian targets to Russian organizations, using a layered intrusion chain that culminates in attempts to compromise Active Directory domain controllers.

The campaign illustrates a familiar but dangerous enterprise compromise pattern: attackers do not need a novel zero-day exploit when exposed remote access, unpatched internal systems, and excessive Active Directory privileges give them a practical route to domain-wide control.

In investigated incidents, NightEagle obtained initial access using compromised legitimate credentials for corporate VPN services.

Connections were observed from Russian IP space associated with Cloudflare WARP tunnels and from European virtual private server infrastructure, enabling the operators to blend malicious access with apparently valid remote logins.

After entering the environment, the group deployed GhostContainer on Microsoft Exchange servers.

The .NET-based implant incorporates publicly accessible components, including Neo-reGeorg, code associated with CVE-2020-0688 exploitation, and the GhostWebShell class from ysoserial.

Kaspersky assesses that operators likely extracted ASP.NET cryptographic keys, manipulated the VIEWSTATE parameter, and executed the payload in memory rather than relying on a conventional on-disk web shell.

GhostContainer processes command-and-control traffic through x-owa-urlpostdata headers and includes mechanisms intended to weaken host visibility, including patching functions associated with AMSI and Windows event logging.

This makes Exchange a strategic foothold: it is internet-facing, highly privileged, and ordinarily trusted inside a corporate network.

NightEagle used GitHub-hosted archives disguised as legitimate software packages to stage tunneling utilities.

Kaspersky’s Global Emergency Response Team linked the activity, to stolen VPN credentials, the GhostContainer Microsoft Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync-based credential replication.

The operators combined Microsoft Dev Tunnels with the public rdp2tcp utility, allowing them to expose or relay Remote Desktop Protocol traffic without necessarily opening conspicuous new inbound ports on compromised systems.

NightEagle Attack Chain

Microsoft Dev Tunnels is a legitimate developer service that can publish local services through *.devtunnels.ms domains.

In this campaign, it was reportedly used to expose TCP port 3389, while rdp2tcp carried TCP traffic through an established RDP connection.

The pairing provides a covert lateral-movement route and complicates detection because part of the traffic relies on legitimate cloud infrastructure.

Defenders should scrutinize Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational events 132 and 148.

These events record RDP virtual-channel creation and closure; channel names such as rdp2tcp, or unexpected random alphanumeric names, can indicate tunneling activity rather than ordinary RemoteFX use.

The most consequential part of the intrusion involved Active Directory. In one incident, NightEagle exploited CVE-2019-0708, widely known as BlueKeep, an RDP vulnerability affecting vulnerable Windows systems.

The actors used the exploit to create a local account and add it to the local Administrators and Remote Desktop Users groups, establishing a stronger position for lateral movement.

From there, the group requested Kerberos tickets with an unusual combination of Forwardable, Proxiable, and Renewable flags.

Researchers also observed attempts to replicate the Active Directory Domain-Password object through DCSync, a technique in which an attacker with sufficient replication permissions impersonates a domain controller and requests password data from AD.

A successful DCSync operation can expose password hashes for privileged accounts, including accounts that can administer domain controllers.

Combined with long-lived Kerberos tickets and remote-access tunnels, this gives an intruder a durable path to take over the wider Active Directory environment.

Organizations should urgently patch BlueKeep-exposed systems, disable RDP where it is not essential, and enforce network-level authentication and strict segmentation for remaining RDP services.

VPN access should require phishing-resistant MFA, while anomalous logins from anonymizing tunnels or unfamiliar virtual hosting providers should trigger investigation.

Security teams should also monitor Exchange for abnormal VIEWSTATE behavior, suspicious .NET assembly loading, unexpected *.devtunnels.ms DNS activity, netsh interface portproxy changes, Impacket atexec execution, abnormal Kerberos ticket requests, and directory-replication activity from hosts that are not domain controllers.

These controls directly address the techniques NightEagle used to turn an initial VPN compromise into an attempted takeover of enterprise identity infrastructure.

Indicators of compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC