Security researchers have reported a new attack chain adopted by NightEagle (APT-Q-95) T that combines the BlueKeep RCE flaw in Windows Remote Desktop Services with DCSync, a technique used for stealing credentials through Active Directory.

Through this blog, we will understand how the new NightEagle attack chain works, the threat posed by it, and what organizations can do to defend against it.

About the vulnerabilities

Here is how NightEagle targets Russian companies:

After obtaining stolen VPN credentials, NightEagle uses them to enter a company’s internal network. Then they compromise a Microsoft Exchange Server and install a backdoor called GhostContainer. It gives them a smooth way to maintain access and interact with the network.

They use tunneling tools to reach other systems in the network and exploit a Windows Remote Desktop flaw (called BlueKeep) to gain a stronger foothold and to create a privileged local account.

Next, they move towards the Active Directory that manages users, endpoints, and permissions across an organization. With sufficient privileges at hand, they use the DCSync technique to trick Active Directory into giving them password-related information.

Threat posed by the NightEagle attack chain

Attackers can use the chain to:

• Execute arbitrary code on vulnerable Windows systems through BlueKeep.
• Obtain Active Directory password hashes through DCSync.
• Compromise privileged accounts and move laterally within the Windows domain.
• Potentially gain broader control over the organization’s Active Directory environment.

SharkStriker’s recommendations

• Ensure all Windows systems affected by CVE-2019-0708 are fully patched.
• Restrict RDP access to authorized networks or VPN connections.
• Disable RDP where it is not required.
• Apply least-privilege controls to Active Directory replication permissions.