Three Threat Groups Are Quietly Targeting Russian Enterprises—Here's How

Michael Miller · 2026-09-16

When you think of cyberattacks, you might picture a lone hacker in a basement. But what's happening in Russia right now is something far more organized. According to multiple reports from Kaspersky, three distinct threat activity clusters—NightEagle, Hacking Cat, and Toy Ghouls—have set their sights on Russian enterprises. And they're not just throwing random malware at the wall. They're using backdoors, ransomware, and wipers in coordinated campaigns that are evolving fast. ### Who Are These Threat Groups? Kaspersky has been tracking these clusters for a while. NightEagle, also known as APT-Q-95, has been active since at least 2023. This group isn't new to the game, but they've recently stepped up their tactics. They're now using new techniques for persistence and lateral movement, which means they can stay hidden inside a network longer and move from one system to another without being detected. Hacking Cat and Toy Ghouls are less detailed in the reports, but they're part of the same wave of attacks. Each group seems to have its own specialty, but they all share a common goal: disrupting Russian enterprises. ### The Triple Threat: Backdoors, Ransomware, and Wipers Let's break down what these attacks actually look like: - **Backdoors**: These are like secret tunnels that attackers use to get back into a system whenever they want. Once a backdoor is installed, the attacker can come and go as they please, often without triggering any alarms. - **Ransomware**: You've probably heard of this one. It locks up your files and demands payment to unlock them. But in these campaigns, ransomware is often just a distraction or a way to fund the attackers' other activities. - **Wipers**: This is the scary one. Wipers don't just lock your data—they erase it completely. There's no ransom note, no way to recover. It's pure destruction. When you combine these three, you get a powerful toolkit for causing chaos. And that's exactly what these groups are doing. ### Why Russian Enterprises? You might wonder why these groups are targeting Russian enterprises specifically. There are a few theories. Some experts believe it's a form of cyber warfare, possibly tied to geopolitical tensions. Others think it's simply because Russian companies may have weaker defenses compared to their Western counterparts. Either way, the result is the same: businesses are getting hit, and they're struggling to fight back. ### What Can You Learn From This? Even if you're not in Russia, these attacks offer valuable lessons for anyone in cybersecurity: - **Don't underestimate persistence**: Attackers are patient. They'll wait for the right moment to strike. Make sure your defenses are always up to date. - **Layer your security**: Backdoors, ransomware, and wipers require different defenses. A single antivirus program won't cut it. - **Monitor lateral movement**: Once an attacker is inside, they'll try to move around. Keep an eye on unusual activity within your network. ### The Bigger Picture These attacks are a reminder that cyber threats are constantly evolving. The techniques used by NightEagle and others will eventually trickle down to less sophisticated attackers. So even if you're not a target today, you could be tomorrow. As Kaspersky continues to track these groups, we'll likely learn more about their methods. For now, the key takeaway is simple: stay vigilant, keep your systems patched, and never assume you're too small to be a target. In the world of cybersecurity, complacency is the enemy. And these three threat groups are counting on it.