Three Hacking Groups Deploy Custom Malware Against Russian Companies

Russian enterprises have become the focus of coordinated cyberattacks from three distinct threat groups using advanced custom malware and exploiting known vulnerabilities, according to multiple reports from Kaspersky. The cybersecurity firm has identified the threat clusters as NightEagle, Hacking Cat, and Toy Ghouls, each employing different tools and techniques. The attacks span from persistent backdoor access to ransomware deployment and destructive wiper campaigns.

NightEagle, a threat actor active since at least 2023, has been observed using compromised valid credentials to break into corporate VPNs, with connections originating from Russian IP addresses linked to Cloudflare WARP tunnels and European virtual infrastructure providers. The group deploys GhostContainer, a modular backdoor that provides complete control over Microsoft Exchange Servers and can execute arbitrary code, handle file operations, and load extra modules. To move within networks, the attackers download tunneling tools to reroute network traffic through RDP using Microsoft dev tunnels and an open-source program called rdp2tcp. NightEagle has exploited vulnerabilities including CVE-2019-0708 (BlueKeep) to create local accounts and add them to Administrators and Remote Desktop Users groups, while also attempting DCSync attacks to impersonate domain controllers. Hacking Cat, a pro-Ukrainian hacktivist entity operational since February 2024, has shifted from website defacements to encryption and destructive operations in recent months. The group weaponizes Exchange server vulnerabilities to deliver Gorilla RAT, a Go-based remote access trojan, and deploys multiple variants of Monkey ransomware written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi systems. The Rust variant generates a 32-byte key and encrypts files using ChaCha20-Poly1305, with some versions failing to store the key anywhere, effectively transforming them into wiper malware. Toy Ghouls, a financially motivated group active since 2025, has progressed from using leaked Babuk and LockBit ransomware builders to developing its own backdoor first detected in July 2026, available in two variants: mqtt-bird-agent and matrix-bird-agent, which use HiveMQ MQTT broker and Element messenger for command-and-control communications.

The report notes that GhostContainer "incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility." Kaspersky found that Hacking Cat "actively collaborates with other hacktivists such as Cyber Anarchy Squad and the Ukrainian Cyber Alliance", which can make attribution more difficult. The firm theorized that a Golang ransomware variant's inclusion of functionality for removing shadow volume copies, useless in Linux and ESXi environments, "suggests the attackers were careless and likely used AI in developing the toolkit." Following publication, Hacking Cat disputed some attributions on its Telegram channel, stating "a couple of the tools are ours, but the lockers are definitely not."

The attackers' techniques reveal sophisticated approaches to persistence and evasion. NightEagle's ultimate objective is to establish lasting presence in victim infrastructure, obtain password hashes for domain accounts, use long-lived Kerberos tickets to access target resources, and ultimately compromise domain controllers and entire Active Directory environments. The C++ variant of Monkey ransomware can establish persistence through scheduled tasks or RunOnce registry keys, clear system logs, disable logging, wipe PowerShell command history, bypass AMSI, turn off Event Tracing for Windows, and configure Microsoft Defender exclusions. Kaspersky observed that different hacktivist groups using identical self-written tools in separate attacks "may indicate the existence of a common source for such tools – for example, a developer or a small group of developers who create, maintain, and modify the malware, which is subsequently used by various hacktivist groups."

The report highlights that Toy Ghouls' shift "away from publicly available open-source projects toward custom-built tools suggests that Toy Ghouls is working to make its attacks more sophisticated and to evade detection for longer". The Bird Agent backdoor uses unconventional communication channels including HiveMQ MQTT broker and Matrix-based Element messenger, and binds its configuration to specific victim machines by partially encrypting it with a key derived from the system's MachineGuid value. Kaspersky also identified that Hacking Cat has teamed up with Cyber Anarchy Squad to deliver ClearWater ransomware and with Ukrainian Cyber Alliance to deploy Nemo Wiper malware that overwrites files with random bytes and fills remaining disk space. The convergence of multiple threat actors targeting Russian infrastructure with increasingly custom tooling points to an evolving landscape where attribution grows harder and defense becomes more complex. Organizations facing geopolitically motivated adversaries may need to reconsider whether traditional security frameworks adequately account for attackers willing to share capabilities across ideological lines.