ctrlINT What the industry said about every indicator, with the quote

NightEagleThreat actor

  • apt-q-95

NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated techniques, 0 days, and specialized detection avoiding malware. The threat actor seems to have access to significant funding, with dedicated infrastructure, and focuses on low-noise, low-impact intelligence gathering operations.From MISP Galaxy

Last reported 9 days ago, by AhnLab ASEC4 reports

Suspected originUnited StatesMISP Galaxy
Targets sectorsDefence, government, technologyMISP Galaxy
Targets countriesChinaMISP Galaxy

ATT&CK techniques

6 techniques · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique).”

    AhnLab ASECVendor
  2. T1003.006DCSync

    “…ed to replicate the Domain-Password object from the Active Directory database to impersonate the domain controller (a technique known as DCSync) after obtaining an account with sufficient privileges.”

    Kaspersky SecurelistVendor
  3. T1204.003Malicious Image

    “The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”

    Risky Business NewsNews
  4. T1218.002Control Panel

    “VHDX, LNK, PDF, HTA, WSF, MSI, and Control Panel applets were combined.”

    AhnLab ASECVendor
  5. T1552.004Private Keys

    “The modules loaded malicious code that extracted and stole crypto-wallet private keys.”

    Risky Business NewsNews
  6. T1684Social Engineering

    “Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”

    Risky Business NewsNews

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

4 reports, newest first · the exact sentence from each

  1. “Callisto (Star Blizzard), UAC-0099, and NightEagle have escalated their activities.”

    AhnLab ASECVendor
    September 2026 Threat Trend Report on APT Groups

  2. “September reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.”

    Recorded FutureVendor
    September 2026 CVE Landscape

  3. “NightEagle attacks Russia: A suspected North American APT group has shifted from hacking Chinese organizations to targeting Russian companies.”

    Risky Business NewsNews
    Risky Bulletin: Gemini hacked three companies too

  4. “NightEagle targets Russian companies”

    Kaspersky SecurelistVendor
    NightEagle targets Russian companies

Indicators in its reports

named in the reports above
Copy these 12 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with NightEagle here?
No account needed. We do not store your IP address.