aviatrix logoAviatrix
Under Active Attack

Executive Summary

Three distinct threat groups - NightEagle, Hacking Cat, and Toy Ghouls - launched coordinated attacks against Russian enterprises throughout 2026, deploying backdoors, ransomware, and wipers. NightEagle leveraged compromised VPN credentials and the GhostContainer backdoor to target Microsoft Exchange servers, while pro-Ukrainian group Hacking Cat deployed Gorilla RAT and multi-platform Monkey ransomware variants. Toy Ghouls evolved from using leaked ransomware builders to developing custom Bird Agent backdoors that communicate via unconventional channels like MQTT brokers and Matrix messaging.

This campaign demonstrates the increasing sophistication of multi-vector attacks and the growing trend of hacktivist groups collaborating to share custom toolsets, representing a significant escalation in cyber warfare targeting critical infrastructure.

Why This Matters Now

Nation-state and hacktivist groups are increasingly collaborating and sharing sophisticated custom malware, while exploiting VPN vulnerabilities and Exchange servers to establish persistent access to enterprise networks.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The groups primarily exploited compromised VPN credentials and vulnerabilities in Microsoft Exchange servers to establish their initial foothold.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of these multi-stage attacks by constraining lateral movement paths and limiting east-west traffic flows between compromised endpoints and critical infrastructure systems.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Identity-aware access controls would likely limit the scope of compromised credential usage, reducing attacker reachability to segmented network zones and constraining initial foothold expansion across cloud workloads.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Micro-segmentation policies would likely constrain privilege escalation scope by isolating domain controllers and limiting cross-workload communication paths, reducing the attacker's ability to perform DCSync operations across network boundaries.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Granular east-west traffic inspection would likely detect and block unauthorized tunneling protocols, constraining lateral movement paths and reducing attacker reachability to sensitive internal infrastructure systems.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Comprehensive traffic visibility would likely identify anomalous communication patterns to MQTT brokers and messaging platforms, constraining command execution capabilities and reducing the effectiveness of unconventional C2 channels.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely limit data exfiltration volumes and restrict unauthorized outbound connections, constraining the attacker's ability to transfer sensitive credentials and system information to external command infrastructure.

Impact (Mitigations)

Residual ransomware deployment would likely be constrained to isolated network segments, reducing the blast radius of encryption operations and limiting cross-workload propagation of destructive payloads across the infrastructure.

Impact at a Glance

Affected Business Functions

  • Email Communication Systems
  • Active Directory Services
  • Remote Access Infrastructure
  • Data Backup and Recovery
Operational Disruption

Estimated downtime: 21 days

Financial Impact

Estimated loss: N/A

Data Exposure

Domain controller credentials, password hashes for domain accounts, Microsoft Exchange Server data, internal network infrastructure details, and potential access to entire Active Directory environments across multiple Russian enterprises

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies and microsegmentation to prevent lateral movement through internal networks and limit blast radius from compromised VPN credentials
  • • Deploy East-West Traffic Security controls with workload-to-workload inspection to detect and block tunneling tools like rdp2tcp and unauthorized RDP traffic redirection attempts
  • • Establish Egress Security & Policy Enforcement with FQDN filtering to block communication with unconventional C2 channels including MQTT brokers and Matrix-based messaging platforms
  • • Enable Multicloud Visibility & Control with centralized policy and traffic observability to detect anomalous automation patterns and suspicious cross-region activities from compromised accounts
  • • Implement Encrypted Traffic inspection capabilities to analyze VPN traffic patterns and detect connections from suspicious infrastructure like Cloudflare WARP tunnels and European VPS providers

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image