Also known as: APT-Q-95, sophistication
NightEagle—also identified as APT‑Q‑95—is a state‑sponsored threat actor that began active campaigns against Chinese defense, government, financial‑services, and critical‑infrastructure organizations at least since 2023. The group’s operations are driven by financial gain but also include targeted collection of military and high‑tech data, often via exploitation of Microsoft Exchange Servers using an undisclosed zero‑day unauthenticated remote code execution vulnerability. Once inside a target network, NightEagle installs memory‑only “memory horse” persistence through IIS process injection, leaving little observable footprint. The adversary harvests the Exchange machineKey to enable credential compromise and unauthorized mailbox access, then deploys custom Go‑based trojans (often built on Chisel) for encrypted command and control channels. Additionally, it leverages ReGeorg web‑shell proxies to construct multi‑hop SOCKS tunnels that facilitate lateral movement across compromised hosts. The actor’s operational profile is marked by night‑time activity, rapid infrastructure pivots using purchased VPSs, disposable domains, and constant anti‑forensic measures such as clearing event logs and monitoring debugging tools. These elements combine to create a highly stealthy, low‑impact intelligence gathering campaign that adapts quickly to changes in geopolitical priorities. While details of exact malware code remain limited outside secondary sources, the combination of zero‑day exploitation, fileless persistence, encrypted tunneling, and dynamic infrastructure indicates an organization with advanced scripting, software engineering and operational security capabilities.
Targeted Sectors
Targeted Countries / Regions
Executive Summary
NightEagle (APT‑Q‑95) is a highly sophisticated nation‑state actor that has exploited an undisclosed zero‑day in Microsoft Exchange Server to infiltrate China’s military, defense and high‑tech sectors. The group uses fileless memory‑horse persistence, Go‑based encrypted tunnels and web‑shell proxies for lateral movement, conducting operations under a strict night‑time schedule aligned with North American time zones. Its stealthy tactics and rapid infrastructure pivots enable low‑noise intelligence gathering across critical sectors.
Goals & Targeting
NightEagle’s strategic objective is dual‑phased: extract high‑value sensitive information—particularly military communications, AI research, and critical infrastructure processes—and monetize these gains through direct financial theft or extortion. The actor specifically targets Chinese entities involved in defense procurement, advanced manufacturing, large language model development, and other technology sectors that can provide actionable intelligence for rival states. Its choice of night‑time operations reduces the risk of detection by typical daytime monitoring regimes while aligning activity with North American business hours to simplify command and control traffic analysis. The targeting also reflects a broader geopolitical agenda, as it has recently focused on large language model organizations amid China’s AI expansion, suggesting adaptability to emerging technological domains. By exploiting Exchange zero‑days, NightEagle can gain broad, privileged access across multiple user accounts, enabling them to harvest emails, documents, and encrypted communications with minimal technical disruption. The actor appears to prefer low‑noise, low‑impact tactics over high‑visibility attacks, likely to maintain long‑term persistence and avoid disrupting the operations of strategic partners that might otherwise alert national defense agencies.
Enhanced Description
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
NightEagle demonstrates a pattern of leveraging newly discovered zero‑days—most notably in Microsoft Exchange—to gain initial footholds, followed by rapid pivoting to multiple VPS back‑ends and disposable domains that rotate frequently. Victim organizations are typically large Chinese military or high‑tech entities, especially those involved in AI and defense manufacturing. The group's operational tempo is measured; each campaign unfolds over weeks of stealthy exfiltration rather than immediate disruptive damage. Past operations have shown a focus on acquiring credential material (e.g., Exchange machineKeys) and sensitive email contents, while avoiding large‑scale sabotage. Notably, the actor has adapted to new targets such as AI companies, indicating a responsive threat landscape aligned with geopolitical developments. Campaigns employ low‑noise activity during overnight hours, limiting visibility by conventional monitoring solutions. The use of fileless persistence means that logs and indicators are often sparse; investigators must look for subtle signs like unusual out‑bound traffic patterns (Go tunnels) or rapid domain changes.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
The assessment is derived mainly from secondary intelligence reports and public disclosures, which provide a high‑level overview of NightEagle’s tactics but lack corroborating technical artifacts. While the use of Exchange zero‑days, memoryhorse persistence, and Chisel tunnels are well described across sources, direct evidence such as malware samples or verified CVE details remains limited. Consequently, confidence is moderate: we can affirm the actor’s general capabilities and targeting approach, but uncertainty persists regarding specific exploit details, full extent of infrastructure, and evolving toolsets. Information gaps include precise CVE identifiers, detailed payload implementations, and long‑term persistence mechanisms beyond the initial intrusion stages. Further on‑ground evidence or verified threat intel would improve confidence in both mitigation strategies and attribution certainty.
No campaigns linked yet.
No observed data linked yet.
14
Techniques
42
Tools
0
Campaigns
34
IOCs
0
Observed Data
9
Tactics