Three Distinct Clusters, Three Different Motives
Kaspersky has published research detailing three separate threat activity clusters currently targeting Russian enterprises, each with a distinct motivation, toolset, and methodology: NightEagle (espionage), Hacking Cat (pro-Ukraine hacktivism), and Toy Ghouls (financially motivated cybercrime).
NightEagle (APT-Q-95)
Active since at least 2023, NightEagle has previously been observed hitting Asian government agencies and tech companies, and has now turned its attention to Russian enterprises.
Tradecraft:
- Uses compromised valid credentials to establish VPN access
- Routes connections through Cloudflare WARP tunnels and European infrastructure to obscure origin
- Exploits CVE-2019-0708 (BlueKeep) for privilege escalation
- Performs DCSync attacks to impersonate domain controllers
- Extracts cryptographic keys from ASP.NET configurations
- Uses Microsoft dev tunnels and rdp2tcp for lateral movement
Malware: A modular backdoor called GhostContainer, which grants full access to compromised Exchange Servers and incorporates components from the Neo-reGeorg tunneling tool and ysoserial.
Hacking Cat
A pro-Ukrainian hacktivist group that has shifted tactics since early 2024, moving from website defacement to encryption-based attacks against Russian targets. It collaborates with the Cyber Anarchy Squad and the Ukrainian Cyber Alliance.
Tradecraft:
- Exploits Exchange vulnerabilities CVE-2021-26855 and CVE-2026-42897
Malware:
- Gorilla RAT (Go-based) — tunnels traffic, executes commands, manages files
- Monkey Ransomware — variants written in Rust, .NET, C++, and Golang, targeting Windows, Linux, and VMware ESXi; some variants act purely as wipers
- ClearWater Ransomware — distributed as ransomware-as-a-service
- Nemo Wiper — developed collaboratively with the Ukrainian Cyber Alliance
Notably, Hacking Cat has publicly disputed attribution for some of these tools, with the group stating "the lockers are definitely not" theirs — suggesting overlapping or rebranded infrastructure among pro-Ukraine hacktivist clusters.
Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf)
A financially motivated group active since 2025 that has evolved from deploying leaked Babuk and LockBit ransomware builders toward proprietary tooling.
Tradecraft:
- Relies on Windows Remote Management (WinRM) for payload delivery
- Uses the open-source tools Evil-WinRM and WinRM-fs
Malware:
- Bird Agent backdoor, in two variants:
mqtt-bird-agent 0.1.0— uses HiveMQ MQTT for command-and-controlmatrix-bird-agent 0.1.0— uses the Element messenger for command-and-control
- GenieLocker ransomware — a custom-built encryptor
Why It Matters
The clustering of espionage, hacktivist, and financially motivated activity against the same national target set illustrates how geopolitically charged environments attract a full spectrum of threat actors simultaneously — each pursuing different objectives but often reusing similar initial-access techniques (compromised credentials, exposed Exchange servers, WinRM). Kaspersky's research underscores that defenders in high-tension regions need to account for overlapping campaigns rather than assuming a single adversary profile.