{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "f488fab7-e683-410e-bcca-ae978a40fe01", "name": "NightEagle", "role": "acteur lié (relation uses)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 6, "direct_entities": 19, "direct_relationships": 27, "invalid_iocs": 0, "iocs": 6, "mentioned": 5, "mitre_associated": 0, "mitre_direct": 0, "targets": 1, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 2 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 56, "excluded_graph_objects": 252, "graph_complete": true, "graph_objects": 19, "graph_relationships": 27, "mitre_context_complete": true, "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "status_as_of": "2026-10-10T15:25:17+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.119Z", "created_at": "2026-09-26T12:04:17.092Z", "modified": "2026-09-26T12:04:25.108Z", "updated_at": "2026-09-26T12:04:25.108Z" }, "description_available": false, "entity_type": "Indicator", "id": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "indicator--d82bfdc9-25d7-566a-b6c1-2066bb70e8af", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:04:14.288Z", "updated_at": "2026-09-26T12:04:14.664Z" }, "description_available": false, "entity_type": "StixFile", "id": "226df97b-90e1-4e7c-a689-7b9c5f28e98d", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "file--d741226b-3416-50fc-8f24-71a5dd3264f7", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.109Z", "created_at": "2026-09-26T12:04:15.383Z", "modified": "2026-09-26T12:04:18.549Z", "updated_at": "2026-09-26T12:04:18.549Z" }, "description_available": false, "entity_type": "Indicator", "id": "24207f64-066e-46f1-9478-8984f79711a4", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "indicator--bef6e02e-0f52-5837-8e0a-a80ff772d083", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:04:13.216Z", "updated_at": "2026-09-26T12:04:13.542Z" }, "description_available": false, "entity_type": "StixFile", "id": "249908e3-cec0-48df-a138-18437c854f18", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "file--74b06543-bad8-5e86-a2c3-25600a46c1c9", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:04:14.403Z", "updated_at": "2026-09-26T12:04:14.824Z" }, "description_available": false, "entity_type": "StixFile", "id": "4a2196b1-21a1-4e8b-ba60-e334373c1071", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "file--c82b2890-11b0-59fd-ab18-0b939f214e98", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:04:14.383Z", "updated_at": "2026-09-26T12:04:14.823Z" }, "description_available": false, "entity_type": "StixFile", "id": "5a4c079d-178d-4941-9968-5815c6a6e39e", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "file--710cf8b5-f965-5f88-a003-5e9d377d3234", "type": "StixFile" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:42.735Z", "modified": "2026-01-18T14:36:43.019Z", "updated_at": "2026-01-18T14:36:43.019Z" }, "description_available": false, "entity_type": "Region", "id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "is_inferred": false, "labels": [], "lang": "en", "name": "Eastern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "location--8ff835b1-bf48-511c-9538-c4ee7bfe9bc6", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.123Z", "created_at": "2026-09-26T12:04:18.252Z", "modified": "2026-09-26T12:04:27.077Z", "updated_at": "2026-09-26T12:04:27.077Z" }, "description_available": false, "entity_type": "Indicator", "id": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "indicator--a9996a3e-3d8c-5bbb-afec-22796b6f9363", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:42.591Z", "modified": "2026-01-18T14:36:42.746Z", "updated_at": "2026-01-18T14:36:42.746Z" }, "description_available": false, "entity_type": "Region", "id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "is_inferred": false, "labels": [], "lang": "en", "name": "Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "location--2e9ef300-a1ab-5c9f-9297-dde66b71cae2", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:04:13.232Z", "updated_at": "2026-09-26T12:04:13.775Z" }, "description_available": false, "entity_type": "StixFile", "id": "6fd74f81-e15f-493f-86fd-d09c4925808f", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "file--b95baaba-6a14-5dba-8f45-8f887a4d6eb5", "type": "StixFile" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2021-11-03T00:00:00.000Z", "created_at": "2026-01-18T19:48:35.813Z", "modified": "2026-05-05T16:24:08.327Z", "updated_at": "2026-05-05T16:24:08.327Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "73fcf709-db40-468c-98c5-c3cfcfd6e36b", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2019-0708", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2019-0708", "id": "8dbadb18-bf8b-4af3-a0df-89ff453c1565", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0708" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "vulnerability--581f393e-d368-576f-84c4-e1dcef5c306a", "type": "Vulnerability" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.012Z", "created_at": "2026-09-26T12:04:08.340Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T12:04:08.843Z", "updated_at": "2026-09-26T12:04:08.843Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "is_inferred": false, "labels": [], "lang": "en", "name": "NightEagle", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "intrusion-set--8b3be9cc-4dc4-567a-a06e-c5777abdc0fb", "type": "IntrusionSet" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:04:13.447Z", "updated_at": "2026-09-26T12:04:13.776Z" }, "description_available": false, "entity_type": "StixFile", "id": "78c6afdf-1cb3-4c44-bb98-a7b15695ff1b", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "file--174c0c66-29d2-5e82-aace-a4ba55f26db0", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.115Z", "created_at": "2026-09-26T12:04:15.778Z", "modified": "2026-09-26T12:04:22.694Z", "updated_at": "2026-09-26T12:04:22.694Z" }, "description_available": false, "entity_type": "Indicator", "id": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "indicator--a11dabc4-d62c-5075-9e43-793acfabd240", "type": "Indicator" }, { "__typename": "Country", "aliases": [ "RU", "RUS" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:36:44.323Z", "modified": "2026-02-23T13:44:40.821Z", "updated_at": "2026-02-23T13:44:40.821Z" }, "description_available": false, "entity_type": "Country", "id": "943fd578-2671-43c0-b698-b21b30065383", "is_inferred": false, "labels": [], "lang": "en", "name": "Russian Federation", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "location--efa1b9b0-dc59-5bad-baa2-4fc495e55fcc", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.112Z", "created_at": "2026-09-26T12:04:15.606Z", "modified": "2026-09-26T12:04:20.039Z", "updated_at": "2026-09-26T12:04:20.039Z" }, "description_available": false, "entity_type": "Indicator", "id": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "indicator--b74a97d3-f5bd-58cc-a8bb-f2cacce6e5d5", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2021-11-03T00:00:00.000Z", "created_at": "2026-01-18T19:48:25.795Z", "modified": "2026-01-21T09:14:27.538Z", "updated_at": "2026-01-21T09:14:27.538Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "c29f344f-9c10-44c4-b11e-ba7c8c2ba12c", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2020-0688", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2020-0688", "id": "9e3dce08-06c2-4ba0-955e-b449b0726dd5", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0688" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "vulnerability--3d52649b-a0d5-5d55-b549-375a7a15df05", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.126Z", "created_at": "2026-09-26T12:04:18.734Z", "modified": "2026-09-26T12:04:29.287Z", "updated_at": "2026-09-26T12:04:29.287Z" }, "description_available": false, "entity_type": "Indicator", "id": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "indicator--0f582921-c400-5319-a14d-6f2edd2b2328", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.013Z", "created_at": "2026-09-26T12:04:08.717Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T12:04:09.182Z", "updated_at": "2026-09-26T12:04:09.182Z" }, "description_available": false, "entity_type": "Malware", "id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "is_inferred": false, "labels": [], "lang": "en", "name": "GhostContainer", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "malware--fd605cd8-b213-566e-83b1-28e58c959488", "type": "Malware" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.125Z", "created_at": "2026-09-26T12:05:36.939Z", "modified": "2026-09-26T12:05:37.532Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:37.532Z" }, "description_available": false, "entity_type": "based-on", "fromId": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "from_id": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "from_name": null, "from_type": "Indicator", "id": "097a7ed1-2bf0-41e2-885c-1a25db87c8ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--2927fc66-4e7b-5b32-ae0b-39f306d0f65f", "toId": "5a4c079d-178d-4941-9968-5815c6a6e39e", "to_id": "5a4c079d-178d-4941-9968-5815c6a6e39e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.128Z", "created_at": "2026-09-26T12:05:36.945Z", "modified": "2026-09-26T12:05:37.533Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:37.533Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "from_id": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "from_name": null, "from_type": "Indicator", "id": "12463c1e-2403-426e-aca6-3b82c4ae6fa2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--4259510f-d337-5be5-aa1c-ac75836f93ee", "toId": "4a2196b1-21a1-4e8b-ba60-e334373c1071", "to_id": "4a2196b1-21a1-4e8b-ba60-e334373c1071", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.129Z", "created_at": "2026-09-26T12:05:37.842Z", "modified": "2026-09-26T12:05:38.047Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:38.047Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24207f64-066e-46f1-9478-8984f79711a4", "from_id": "24207f64-066e-46f1-9478-8984f79711a4", "from_name": null, "from_type": "Indicator", "id": "15a650d3-3b3f-41f9-a0d1-fd86d9598f77", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--60e0e89f-b931-5e9b-a4b2-c1cf8edf3fba", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.191Z", "created_at": "2026-09-26T12:06:40.301Z", "modified": "2026-09-26T12:06:40.443Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:40.443Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "from_id": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "from_name": null, "from_type": "Indicator", "id": "17edac8b-840a-442a-a389-44b0941812b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--1d717d52-0845-5891-82e1-61306b5cface", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.114Z", "created_at": "2026-09-26T12:05:34.761Z", "modified": "2026-09-26T12:05:35.672Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:35.672Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "from_id": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "from_name": null, "from_type": "Indicator", "id": "25ad47e1-dc30-457d-82f8-48469b76b53d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--a9920fdf-428c-57d9-862e-d81ad18b2b23", "toId": "249908e3-cec0-48df-a138-18437c854f18", "to_id": "249908e3-cec0-48df-a138-18437c854f18", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.117Z", "created_at": "2026-09-26T12:05:34.890Z", "modified": "2026-09-26T12:05:36.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:36.101Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "from_id": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "from_name": null, "from_type": "Indicator", "id": "29059416-0de1-4048-919a-3adf3bad6371", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--39181d95-e2cf-50b4-a9f3-7e637c2f9e27", "toId": "78c6afdf-1cb3-4c44-bb98-a7b15695ff1b", "to_id": "78c6afdf-1cb3-4c44-bb98-a7b15695ff1b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.208Z", "created_at": "2026-09-26T12:06:55.415Z", "modified": "2026-09-26T12:06:55.571Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:55.571Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "from_id": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "from_name": null, "from_type": "Indicator", "id": "3a7c7008-e393-4330-9c50-0a68364accf3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--6aa93ef7-2340-595a-a998-a4daeba00721", "toId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_name": "NightEagle", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.080Z", "created_at": "2026-09-26T12:05:17.347Z", "modified": "2026-09-26T12:05:17.677Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:17.677Z" }, "description_available": false, "entity_type": "targets", "fromId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "from_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "from_name": "GhostContainer", "from_type": "Malware", "id": "4e18ff4a-92dd-48e9-961b-cfed175c04c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--9c6451e3-0590-54e3-95ae-446775aacccb", "toId": "73fcf709-db40-468c-98c5-c3cfcfd6e36b", "to_id": "73fcf709-db40-468c-98c5-c3cfcfd6e36b", "to_name": "CVE-2019-0708", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.075Z", "created_at": "2026-09-26T12:04:18.840Z", "modified": "2026-09-26T12:04:19.098Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:04:19.098Z" }, "description_available": false, "entity_type": "targets", "fromId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_name": "NightEagle", "from_type": "IntrusionSet", "id": "529a2571-fe91-4460-882b-508fd6c3770b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--60110cc0-6084-5c35-a141-056ad1549b51", "toId": "943fd578-2671-43c0-b698-b21b30065383", "to_id": "943fd578-2671-43c0-b698-b21b30065383", "to_name": "Russian Federation", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.076Z", "created_at": "2026-09-26T12:04:20.233Z", "modified": "2026-09-26T12:04:20.509Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:04:20.509Z" }, "description_available": false, "entity_type": "targets", "fromId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "from_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "from_name": "GhostContainer", "from_type": "Malware", "id": "537c9a38-68a1-4df1-8047-0f8dcb95c682", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--1a9f73a3-185f-55ea-9931-d674076dddc1", "toId": "943fd578-2671-43c0-b698-b21b30065383", "to_id": "943fd578-2671-43c0-b698-b21b30065383", "to_name": "Russian Federation", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.162Z", "created_at": "2026-09-26T12:06:08.427Z", "modified": "2026-09-26T12:06:09.642Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:09.642Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "from_id": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "from_name": null, "from_type": "Indicator", "id": "556bf266-8cfa-4204-a372-bec4ced05c9c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--ecc148ff-f372-594c-a402-efaa0c8bfeac", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.175Z", "created_at": "2026-09-26T12:06:22.900Z", "modified": "2026-09-26T12:06:23.541Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:23.541Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "from_id": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "from_name": null, "from_type": "Indicator", "id": "6aee45eb-08cf-4c3b-b3bb-1479832b4765", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--6ec999e8-2b1a-5e61-8879-48e08aca1dfe", "toId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_name": "NightEagle", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:39:19.018Z", "modified": "2026-01-18T14:39:19.710Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:19.710Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "from_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "from_name": "Eastern Europe", "from_type": "Region", "id": "6dae7889-c931-4182-be78-1c7cd2b70dd8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--20f37797-8c45-548e-996f-36884bf9bca9", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.122Z", "created_at": "2026-09-26T12:05:35.098Z", "modified": "2026-09-26T12:05:36.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:36.102Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "from_id": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "from_name": null, "from_type": "Indicator", "id": "82966c73-115e-4ce3-9dac-34b5ddf08a6b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--476d5b5b-d67e-52b0-9901-f9956a653896", "toId": "226df97b-90e1-4e7c-a689-7b9c5f28e98d", "to_id": "226df97b-90e1-4e7c-a689-7b9c5f28e98d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.209Z", "created_at": "2026-09-26T12:06:57.019Z", "modified": "2026-09-26T12:06:57.242Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:57.242Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "from_id": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "from_name": null, "from_type": "Indicator", "id": "8687e639-5c3a-4ea6-9753-e69d13049f10", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--041cb602-840b-581b-870e-da7292faaf3d", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.080Z", "created_at": "2026-09-26T12:05:18.147Z", "modified": "2026-09-26T12:05:18.340Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:18.340Z" }, "description_available": false, "entity_type": "targets", "fromId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "from_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "from_name": "GhostContainer", "from_type": "Malware", "id": "908a5fe6-fcdd-40d2-ab6c-b9836b498357", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--73d57b38-e8ee-566f-a7ef-d633aa94a960", "toId": "c29f344f-9c10-44c4-b11e-ba7c8c2ba12c", "to_id": "c29f344f-9c10-44c4-b11e-ba7c8c2ba12c", "to_name": "CVE-2020-0688", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.191Z", "created_at": "2026-09-26T12:06:39.631Z", "modified": "2026-09-26T12:06:39.918Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:39.918Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "from_id": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "from_name": null, "from_type": "Indicator", "id": "9c277bbd-fa8f-4ef3-bc2c-af939c3b3bc9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--cb0155e1-e634-5d6b-9edf-9ae277b6eb1a", "toId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_name": "NightEagle", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.161Z", "created_at": "2026-09-26T12:06:07.738Z", "modified": "2026-09-26T12:06:07.938Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:07.938Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "from_id": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "from_name": null, "from_type": "Indicator", "id": "b092d430-42ce-442c-b82a-201c185b512f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--f3ee8d91-7a1f-57b8-9f3e-8ffbd89dd604", "toId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_name": "NightEagle", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.078Z", "created_at": "2026-09-26T12:05:15.764Z", "modified": "2026-09-26T12:05:16.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:16.130Z" }, "description_available": false, "entity_type": "targets", "fromId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_name": "NightEagle", "from_type": "IntrusionSet", "id": "c2c95d48-dbbe-4ed5-b61a-cee8e4681963", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--9c835ce1-74fc-5584-9752-0f62e95ad681", "toId": "73fcf709-db40-468c-98c5-c3cfcfd6e36b", "to_id": "73fcf709-db40-468c-98c5-c3cfcfd6e36b", "to_name": "CVE-2019-0708", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.129Z", "created_at": "2026-09-26T12:05:36.939Z", "modified": "2026-09-26T12:05:37.503Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:37.503Z" }, "description_available": false, "entity_type": "indicates", "fromId": "24207f64-066e-46f1-9478-8984f79711a4", "from_id": "24207f64-066e-46f1-9478-8984f79711a4", "from_name": null, "from_type": "Indicator", "id": "c5f784a5-9ab4-430c-90c9-6ebcdb21b858", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--b9c9da1f-34f6-52ff-b4c4-d16fc4e43bef", "toId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_name": "NightEagle", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.176Z", "created_at": "2026-09-26T12:06:23.865Z", "modified": "2026-09-26T12:06:24.090Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:06:24.090Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "from_id": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "from_name": null, "from_type": "Indicator", "id": "cd861593-bb7a-4716-ad0e-ca3a0d79ff99", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--7891e7d3-60e7-5e85-8c09-5ad3540322f0", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.111Z", "created_at": "2026-09-26T12:05:33.212Z", "modified": "2026-09-26T12:05:33.415Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:33.415Z" }, "description_available": false, "entity_type": "based-on", "fromId": "24207f64-066e-46f1-9478-8984f79711a4", "from_id": "24207f64-066e-46f1-9478-8984f79711a4", "from_name": null, "from_type": "Indicator", "id": "cdd7d5ff-f2d4-420c-b7a7-74cb59d8ca9a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--1431e4da-aa83-52b2-aea2-e3ceb08b013c", "toId": "6fd74f81-e15f-493f-86fd-d09c4925808f", "to_id": "6fd74f81-e15f-493f-86fd-d09c4925808f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.079Z", "created_at": "2026-09-26T12:05:16.622Z", "modified": "2026-09-26T12:05:16.840Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:16.840Z" }, "description_available": false, "entity_type": "targets", "fromId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_name": "NightEagle", "from_type": "IntrusionSet", "id": "e75dc4bc-d116-43e5-ae6c-3b0aa1b09098", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--c3c35031-ce07-5f52-a238-8f7382975fe7", "toId": "c29f344f-9c10-44c4-b11e-ba7c8c2ba12c", "to_id": "c29f344f-9c10-44c4-b11e-ba7c8c2ba12c", "to_name": "CVE-2020-0688", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.015Z", "created_at": "2026-09-26T12:04:24.065Z", "modified": "2026-09-26T12:04:24.604Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:04:24.604Z" }, "description_available": false, "entity_type": "uses", "fromId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "from_name": "NightEagle", "from_type": "IntrusionSet", "id": "f488fab7-e683-410e-bcca-ae978a40fe01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--9ddf5c00-9fa6-5b2e-9a2e-968c91d618f4", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.144Z", "created_at": "2026-09-26T12:05:53.837Z", "modified": "2026-09-26T12:05:54.141Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:54.141Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "from_id": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "from_name": null, "from_type": "Indicator", "id": "f7e0478c-4004-4d35-8a92-a54dfcadd01b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--ef49915d-1d5a-5329-9520-2777dcb68a34", "toId": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "to_name": "GhostContainer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:53.143Z", "created_at": "2026-09-26T12:05:53.022Z", "modified": "2026-09-26T12:05:53.583Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:05:53.583Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "from_id": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "from_name": null, "from_type": "Indicator", "id": "f7f83849-8ff3-4563-ac31-b9cce4594d5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--9b07ce6b-4bc0-5e04-9cf6-d866a9267862", "toId": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_id": "76246ed8-3ba9-44e1-b5d5-48ffd7157fec", "to_name": "NightEagle", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:39:24.803Z", "modified": "2026-01-18T14:39:25.133Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:25.133Z" }, "description_available": true, "entity_type": "located-at", "fromId": "943fd578-2671-43c0-b698-b21b30065383", "from_id": "943fd578-2671-43c0-b698-b21b30065383", "from_name": "Russian Federation", "from_type": "Country", "id": "f81315b1-b95e-4a6e-9819-88e18e97c458", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "standard_id": "relationship--ba1e9e71-42ee-5638-a83f-15949de67a6a", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1dcafb7f8448683281106b06dd22409a", "description_available": false, "object_id": "24207f64-066e-46f1-9478-8984f79711a4", "object_ids": [ "24207f64-066e-46f1-9478-8984f79711a4", "6fd74f81-e15f-493f-86fd-d09c4925808f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "24207f64-066e-46f1-9478-8984f79711a4", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "1dcafb7f8448683281106b06dd22409a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "6fd74f81-e15f-493f-86fd-d09c4925808f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1dcafb7f8448683281106b06dd22409a" } ], "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "type": "md5", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "1dcafb7f8448683281106b06dd22409a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1f3034b706c78b35d8e34044e68c693a", "description_available": false, "object_id": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "object_ids": [ "249908e3-cec0-48df-a138-18437c854f18", "bbb18aa6-17c8-492c-81b3-627e3a8b52da" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bbb18aa6-17c8-492c-81b3-627e3a8b52da", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "1f3034b706c78b35d8e34044e68c693a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "249908e3-cec0-48df-a138-18437c854f18", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1f3034b706c78b35d8e34044e68c693a" } ], "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "type": "md5", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "1f3034b706c78b35d8e34044e68c693a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3ecd1cd627d0340c92901a478a7caad8", "description_available": false, "object_id": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "object_ids": [ "78c6afdf-1cb3-4c44-bb98-a7b15695ff1b", "8d97fc3d-92b9-4193-98be-dc873ef2d417" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8d97fc3d-92b9-4193-98be-dc873ef2d417", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "3ecd1cd627d0340c92901a478a7caad8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "78c6afdf-1cb3-4c44-bb98-a7b15695ff1b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3ecd1cd627d0340c92901a478a7caad8" } ], "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "type": "md5", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "3ecd1cd627d0340c92901a478a7caad8" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4aa9fb1bf9223dfcdac920759bc7a3c7", "description_available": false, "object_id": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "object_ids": [ "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "226df97b-90e1-4e7c-a689-7b9c5f28e98d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0923b9dc-8f1d-44c4-b8d6-243c3915ae90", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "4aa9fb1bf9223dfcdac920759bc7a3c7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "226df97b-90e1-4e7c-a689-7b9c5f28e98d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4aa9fb1bf9223dfcdac920759bc7a3c7" } ], "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "type": "md5", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "4aa9fb1bf9223dfcdac920759bc7a3c7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "138614a0dd4017855bc379233685364a6f955ad9", "description_available": false, "object_id": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "object_ids": [ "5a4c079d-178d-4941-9968-5815c6a6e39e", "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "65c74bb7-f8e5-40bb-b1b8-a7ca894d74b7", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "138614a0dd4017855bc379233685364a6f955ad9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5a4c079d-178d-4941-9968-5815c6a6e39e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "138614a0dd4017855bc379233685364a6f955ad9" } ], "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "type": "sha1", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "138614a0dd4017855bc379233685364a6f955ad9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "99cb8000ab5e4625a2a23834dde681c25eee9095bb4fa751458bcc0cec6e194f", "description_available": false, "object_id": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "object_ids": [ "4a2196b1-21a1-4e8b-ba60-e334373c1071", "d50c3601-378c-469d-a66f-6c2ea6646ad1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d50c3601-378c-469d-a66f-6c2ea6646ad1", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "99cb8000ab5e4625a2a23834dde681c25eee9095bb4fa751458bcc0cec6e194f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "4a2196b1-21a1-4e8b-ba60-e334373c1071", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "99cb8000ab5e4625a2a23834dde681c25eee9095bb4fa751458bcc0cec6e194f" } ], "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/", "type": "sha256", "valid_from": "2026-09-16T12:31:14.000Z", "valid_until": "2027-07-03T23:40:58.557Z", "validity_status": "active", "value": "99cb8000ab5e4625a2a23834dde681c25eee9095bb4fa751458bcc0cec6e194f" } ], "mentioned": [ { "confidence": 50, "evidence_id": "fd4d3bb4-98a2-480d-abb1-a58dce26bdc6", "name": "GhostContainer", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "name": "Eastern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "name": "Europe", "role": "mentionné", "type": "Region" }, { "confidence": 80, "evidence_id": "73fcf709-db40-468c-98c5-c3cfcfd6e36b", "name": "CVE-2019-0708", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "c29f344f-9c10-44c4-b11e-ba7c8c2ba12c", "name": "CVE-2020-0688", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-16T12:31:14.062Z", "created_at": "2026-09-26T12:07:12.075Z", "modified": "2026-09-26T12:07:25.722Z", "published": "2026-09-16T12:31:14.062Z", "updated_at": "2026-09-26T12:07:25.722Z" }, "description_available": true, "id": "9d76c970-3433-4aac-b3a5-4d39d730f7bf", "is_inferred": false, "labels": [ "active directory", "apt-q-95", "bluekeep", "ghostcontainer", "microsoft exchange", "nighteagle", "vpn compromise" ], "lang": "en", "name": "NightEagle targets Russian companies", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-16T12:31:14.062Z", "references": [ { "external_id": null, "id": "d6409b96-8fbf-4f82-85fe-c05d858a1ace", "source_name": "alien-vault", "url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/" }, { "external_id": "6aaa8c12baf8c0157f30d354", "id": "3c44319f-2f21-4434-b679-df7922ccd61a", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aaa8c12baf8c0157f30d354" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/" }, "targets": [ { "confidence": 50, "evidence_id": "537c9a38-68a1-4df1-8047-0f8dcb95c682", "name": "Russian Federation", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [], "vulnerabilities": [ "CVE-2019-0708", "CVE-2020-0688" ] }, "report_id": "9d76c970-3433-4aac-b3a5-4d39d730f7bf", "schema_version": 1, "selected_date": "2026-09-16", "source_url": "https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/" }