Kaspersky has reported that three (3) distinct threat clusters (NightEagle, Hacking Cat, and Toy Ghouls) are actively targeting enterprises in Russia. NightEagle (APT Q 95) uses stolen credentials to access corporate VPNs via Cloudflare WARP and European VPS IPs, then deploys GhostContainer, a modular backdoor on Microsoft Exchange that masquerades as a legitimate server component. It incorporates open source tools (Neo reGeorg, CVE 2020 0688 exploit, GhostWebShell) and likely abuses VIEWSTATE to launch in memory. For lateral movement, NightEagle uses RDP tunneling (Microsoft dev tunnels, rdp2tcp), exploits AD flaws and BlueKeep (CVE 2019 0708), and performs DCSync attacks to gain domain controller and Kerberos persistence. Hacking Cat, a pro Ukrainian hacktivist group, has shifted from defacements to Gorilla RAT (remote access trojan) and multi platform Monkey ransomware (Rust, .NET, C++, Go) targeting Windows, Linux, and ESXi, with some variants effectively acting as wipers. It also collaborates with Cyber Anarchy Squad and Ukrainian Cyber Alliance to deploy ClearWater ransomware and Nemo Wiper, though Hacking Cat disputes some tool attributions. Toy Ghouls, a financially motivated group, now uses a custom Bird Agent backdoor (HiveMQ MQTT or Matrix/Element C2), delivered via WinRM with tools like Evil WinRM. Bird Agent binds its encrypted config to each host via MachineGuid, runs as a service, and executes hidden PowerShell or CLI commands, signaling a shift in tactics towards a more bespoke, stealthy tooling.