NightEagle
Also known as APT-Q-95
Reports
4
First seen
Sep 16, 2026
Last seen
Oct 13, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×3×3
Russia×3
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1505.003 Web Shell ×4T1078 Valid Accounts ×4T1068 Exploitation for Privilege Escalation ×3T1003 OS Credential Dumping ×3T1021.002 Remote Services: SMB/Windows Admin Shares ×3T1190 Exploit Public-Facing Application ×2T1005 Data from Local System ×2T1021.001 Remote Services: Remote Desktop Protocol ×2T1486 Data Encrypted for Impact ×2T1087 Account Discovery ×1T1219 Remote Access Software ×1T1583.001 Acquire Infrastructure: Domains ×1
Indicators
cve ×31filename ×9hash_md5 ×5domain ×4
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2019-0708 (exploited)CVE-2020-0688 (exploited)CVE-2020-1938 (exploited)CVE-2021-26855 (exploited)CVE-2021-29441 (exploited)CVE-2021-38003 (exploited)CVE-2021-43798 (exploited)CVE-2021-44228 (exploited)CVE-2022-0847 (exploited)CVE-2022-22965 (exploited)CVE-2023-54391 (exploited)CVE-2024-4956 (exploited)CVE-2026-20079 (exploited)CVE-2026-20316 (exploited)CVE-2026-35273 (exploited)CVE-2026-42897 (exploited)CVE-2026-51990 (exploited)CVE-2026-60004 (exploited)CVE-2026-60137 (exploited)CVE-2026-63030 (exploited)
Recent reports
Critical