Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky reported three clusters of attacks on Russian enterprises: NightEagle (APT-Q-95), Hacking Cat, and Toy Ghouls. The NightEagle group has been active since at least 2023 and uses new methods for persistence and lateral movement.

• Kaspersky tracks three groups: NightEagle, Hacking Cat, and Toy Ghouls
• NightEagle (APT-Q-95) active since at least 2023
• Attacks use backdoors, ransomware, and wipers
• New persistence and lateral movement techniques identified