NightEagle targets Russian companies

Kaspersky Securelist reporting highlights multiple 2026 campaigns involving APT groups and malware targeting Russian organizations, aviation and FinTech, industrial environments, Android vehicle head units, and video-conferencing infrastructure. Key activity includes exploitation of Active Directory, RDP, and unpatched TrueConf servers; backdoors using GitHub, MQTT, and Matrix-based messaging for command and control; kernel-level rootkits; proxy botnets; credential and Telegram data theft; and malware disguised as legitimate software or adware. The feed also includes broader vulnerability, ICS