Night Eagle Abuses ASP.NET Virtual Directories in Attacks

EXECUTIVE SUMMARY

Night Eagle (APT-Q-95) is a well-funded APT group tracked by Qianxin Pangu, known for using unknown Exchange exploit chains and dynamic infrastructure such as rotating IPs and unique domains per target. Their operations are focused on Chinese sectors including high-tech, semiconductors, AI, and military industries, aiming to steal sensitive data and intellectual property. Attacks occur exclusively during China’s night hours, and the group deletes traces after data exfiltration. Their spoofed domains, like synologyupdates[.]com, resolve to private IPs during inactive periods to avoid detection. The attack was initially discovered through abnormal DNS traffic flagged by Qianxin Tianyan NDR and further analyzed by AISOC and Tianqing EDR platforms.[emaillocker id="1283"]

The group used a modified Chisel tunneling tool disguised as SynologyUpdate.exe, which set up scheduled SOCKS proxies connecting to C&C infrastructure every four hours. It included hard-coded credentials and skipped TLS checks. The compromised host communicated with the internal Exchange server, leading to the discovery of fileless malware loaded via malicious ASP.NET DLLs (App_Web_cn*[.]dll). These created virtual directories (e.g., ~/auth/lang/cn[.]aspx), which triggered the malware in memory using embedded .NET assemblies. Attackers used these paths to execute payloads without writing to disk, avoiding traditional detection. They exploited unknown Exchange vulnerabilities to steal machineKeys, enabling deserialization and remote access to mailbox data across multiple versions of Exchange.

Night Eagle operates during fixed nighttime hours based on UTC-8, pointing to a likely U.S. origin. Their infrastructure includes unique domains registered through Tucows and IPs from providers like DigitalOcean and Akamai. Each attack uses a unique domain and payload, with DNS patterns showing loopback IPs during idle times and U.S.-based IPs during active sessions. Targeting has shifted with geopolitical changes, including attacks on China’s AI and LLM sectors. Spoofed domains like comfyupdate[.]org mirror legitimate tools to blend in. The group’s malware is launched via scheduled tasks at regular intervals, showing disciplined control and a clear focus on long-term.

THREAT PROFILE:

REFERENCES:

• Eventus Security Threat Research & Development Team