Three Threat Groups Hit Russian Firms With Backdoors, Ransomware and Wipers, Kaspersky Says

Three separate threat clusters are going after Russian companies with backdoors, ransomware and wiper malware, according to new research from Kaspersky reported by The Hacker News. The groups, which Kaspersky tracks as NightEagle, Hacking Cat and Toy Ghouls, have different motives. One runs espionage-style intrusions, one is a hacktivist group that has turned destructive, and one is financially motivated and now builds its own tools.

NightEagle goes after Exchange and Active Directory

NightEagle, also known as APT-Q-95, has been active since at least 2023. “In most incidents, the attackers used compromised valid credentials to gain access to corporate VPNs,” Kaspersky said. The connections came from Russian IP addresses tied to Cloudflare WARP tunnels and from European virtual infrastructure providers.

Once inside, the group installs GhostContainer, a modular backdoor that gives operators full access to Microsoft Exchange servers. It runs in memory and poses as a normal server component. Kaspersky believes it is delivered by pulling the server’s ASP.NET cryptographic keys and injecting a payload through the VIEWSTATE parameter. To move laterally, the group tunnels RDP through Microsoft dev tunnels and rdp2tcp. It exploits Active Directory weaknesses, including BlueKeep (CVE-2019-0708), and attempts DCSync attacks. The end goal is control of the domain controllers and the full AD environment.

Hacking Cat turns destructive

Hacking Cat is a pro-Ukrainian hacktivist group that has done defacements and data leaks since February 2024. Kaspersky says it has recently moved to encryption and destructive attacks. It exploits Exchange flaws, including CVE-2021-26855 and CVE-2026-42897, to drop a Go-based remote access trojan called Gorilla RAT. It then deploys Monkey ransomware in Rust, .NET, C++ and Go variants for Windows, Linux and VMware ESXi. “Some variants do not store the key anywhere, which effectively turns them into full-fledged wiper malware, yet they still leave a ransom note,” Kaspersky said. The Go variant tries to delete volume shadow copies on Linux and ESXi, where they don’t exist. Kaspersky said that “suggests the attackers were careless and likely used AI in developing the toolkit.”

Kaspersky also tied the group to the ClearWater ransomware, used with Cyber Anarchy Squad, and the Nemo Wiper, used with the Ukrainian Cyber Alliance. It suggested a shared developer may be supplying several hacktivist crews. Hacking Cat disputed part of that on Telegram, saying “a couple of the tools are ours, but the lockers are definitely not.”

Toy Ghouls builds its own backdoor

Toy Ghouls, also known as Bearlyfy, Laboo.boo and Feral Wolf, has been active since 2025. It started with leaked Babuk and LockBit builders, moved to its own GenieLocker ransomware, and now uses a custom backdoor first detected in July 2026. The backdoor comes in two variants. One uses a HiveMQ MQTT broker for command and control, and the other uses the end-to-end encrypted Matrix messenger Element. The group delivers the backdoors over Windows Remote Management with open-source tools such as Evil-WinRM. The backdoor’s configuration is encrypted with a key derived from the victim machine’s MachineGuid, so it runs only on that system.

What defenders should check

All three campaigns start with familiar weaknesses: stolen VPN credentials, unpatched Exchange servers and old RDP and Active Directory flaws. Organizations anywhere can act on that. Watch for VPN logins from anonymizing tunnels or unexpected hosting providers, patch Exchange, check for DCSync activity, and limit WinRM access.