Three Hacker Groups Are Quietly Carving Up Russian Enterprise Networks

Kaspersky has published research identifying three distinct threat groups currently running active campaigns against Russian businesses. The three clusters, NightEagle, Hacking Cat, and Toy Ghouls, are using very different tooling and motivations, but they share one thing in common: Russian enterprises are the target.

NightEagle: Patient, Methodical, and Hard to Spot

NightEagle (also tracked as APT-Q-95) has been active since at least 2023 and its recent campaigns show a group that clearly knows what it is doing. Initial access typically comes via stolen legitimate credentials used to log into corporate VPNs, with connections routed through Cloudflare WARP tunnels or European cloud infrastructure. Not exactly shouting from the rooftops.

Once inside, the group deploys GhostContainer, a modular backdoor that gives operators full control over Microsoft Exchange servers. It can execute arbitrary code, handle files, load extra modules, and act as a traffic tunnel. The malware disguises itself as a routine server component to avoid standing out.

The likely delivery method involved extracting cryptographic keys from ASP.NET configuration files, then overwriting the VIEWSTATE parameter to inject a payload that runs entirely in memory. Kaspersky notes the backdoor incorporates components from several public GitHub projects, including the Neo-reGeorg tunnel and a CVE-2020-0688 exploit.

For lateral movement, the group uses Microsoft dev tunnels and rdp2tcp to redirect traffic over RDP, then exploits Active Directory vulnerabilities to escalate privileges. CVE-2019-0708, better known as BlueKeep, gets used to create a local admin account, while DCSync attacks are used to impersonate domain controllers and harvest password hashes. The end state is full domain compromise: long-lived Kerberos tickets, access to all target resources, and ownership of Active Directory.

Hacking Cat: Hacktivists Who Graduated to Ransomware

Hacking Cat started out doing what most hacktivists do: defacing websites and leaking data. The pro-Ukrainian group has been active since February 2024, but recently pivoted hard toward encryption and destructive payloads.

The group exploits Exchange server vulnerabilities (CVE-2021-26855 and CVE-2026-42897) to drop Gorilla RAT, a Go-written remote access trojan that tunnels traffic back to operators and supports the usual grab-bag of remote control features: running commands, enumerating processes, uploading and downloading files, opening TCP tunnels.

Their ransomware offering, dubbed Monkey, comes in four flavours written in Rust, .NET, C++, and Golang, targeting Windows, Linux, and VMware ESXi. The oldest known Monkey sample dates to late summer 2025. Here is where things get interesting. The Rust variant encrypts files with ChaCha20-Poly1305 using a 32-byte key, but in some cases that key is never stored anywhere. Technically ransomware. Functionally a wiper. They still leave a ransom note, which is either theatrical or confused, possibly both.

The .NET variant sends the key to a C2 server and also pulls Microsoft Outlook credentials for good measure. The C++ version is the most fully featured, packing AMSI bypass, ETW disabling, scheduled task persistence, log clearing, and anti-recovery measures. The Golang variant, designed for Linux and ESXi, includes code to delete volume shadow copies, which have no relevance on those operating systems.

Kaspersky theorises the shadow copy code slipping into a Linux build suggests the developers were careless, and possibly used AI to assemble the toolkit. Given how many AI-assisted malware builds have surfaced in the past year, that is not an unreasonable inference.

Hacking Cat also collaborated with the Cyber Anarchy Squad to deploy ClearWater ransomware, and with the Ukrainian Cyber Alliance to drop Nemo Wiper, which overwrites files with random bytes and stuffs remaining disk space with randomly named files carrying a .lock extension.

For what it is worth, Hacking Cat pushed back on Telegram after Kaspersky's report dropped, claiming some tools are theirs but not the ransomware components, and accusing Kaspersky of sloppy attribution. Whether that is accurate or just standard denial is hard to say from the outside.

Toy Ghouls: Going Custom

Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf) is a financially motivated group active since 2025 that started life reusing leaked Babuk and LockBit ransomware builders. They then moved to a custom ransomware called GenieLocker, and have now developed a bespoke backdoor. That trajectory suggests a group actively investing in capability development rather than staying comfortable with off-the-shelf tools.

The new backdoor, Bird Agent, was first spotted in July 2026 and comes in two variants. One uses the HiveMQ MQTT broker for command and control. The other uses Element, a Matrix-based end-to-end encrypted messaging app. Both are delivered via Windows Remote Management using open-source tools Evil-WinRM and WinRM-fs.

Once running, Bird Agent looks for a config file, encrypts it using a key derived from the machine's MachineGuid registry value, and ties itself to that specific system. If it cannot decrypt the config on a subsequent run, it stops entirely. A neat anti-analysis measure.

The MQTT variant fetches commands from HiveMQ via HTTP GET requests and executes them through PowerShell in hidden mode. The Element variant does much the same thing but uses the Windows command line instead. Both exfiltrate results back to the C2.

Using MQTT brokers and encrypted messaging apps as C2 channels is not entirely novel, but it is still far less common than the usual HTTPS callbacks, which makes detection harder. Kaspersky reads the shift toward custom tooling as a deliberate move to improve operational security and extend the group's time-on-target before detection.

Three groups, three sets of motivations, and three increasingly capable toolkits. Russian enterprises are having a rough time of it.