NightEagle APT (APT-Q-95) GhostContainer Exchange Backdoor + PeckBirdy Casino Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack

---
title: NightEagle GhostContainer Webshell Deployment on Exchange Server
id: 8f3a1c2e-9n4e-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects IIS worker process (w3wp.exe) on Exchange servers spawning suspicious child processes or writing ASPX files, consistent with GhostContainer/Neo-reGeorg webshell deployment following CVE-2020-0688 exploitation
author: Security Arsenal Threat Intelligence
date: 2026/09/16
references:
    - https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\whoami.exe'
            - '\nltest.exe'
            - '\rundll32.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    filter_owa:
        CommandLine|contains:
            - 'healthcheck'
            - 'OAB'
    condition: selection_parent and selection_child and not filter_owa
falsepositives:
    - Exchange cumulative update installation
    - Legitimate Exchange management tooling
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1505.003
    - attack.persistence
---
title: Neo-reGeorg Tunneling - Webshell File Creation in Exchange Web Directories
id: 7e2b0d1f-8m3d-4b6c-9d7e-2f3a4b5c6d7e
status: experimental
description: Detects creation of ASPX/ASP files in Exchange and IIS web root directories by non-standard processes, indicative of Neo-reGeorg tunnel webshell deployment
author: Security Arsenal Threat Intelligence
date: 2026/09/16
references:
    - https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\FrontEnd\HttpProxy\'
            - '\inetpub\wwwroot\'
            - '\ClientAccess\'
            - '\MSExchange\'
    selection_ext:
        TargetFilename|endswith:
            - '.aspx'
            - '.asp'
            - '.ashx'
            - '.asmx'
    filter_legit:
        Image|endswith:
            - '\setup.exe'
            - '\TiWorker.exe'
            - '\msiexec.exe'
    condition: selection_path and selection_ext and not filter_legit
falsepositives:
    - Exchange CU/SP installations (filtered by installer processes)
level: critical
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.command_and_control
    - attack.t1071.001
---
title: PeckBirdy Casino Infrastructure DNS Resolution
id: 6d1c9e0a-7l2c-4c7d-8e6f-3a4b5c6d7e8f
status: experimental
description: Detects DNS queries to known PeckBirdy scambling/casino infrastructure domains associated with money laundering, fraud, and espionage cover operations
author: Security Arsenal Threat Intelligence
date: 2026/09/16
references:
    - https://www.infoblox.com/blog/threat-intelligence/how-money-laundering-scams-and-espionage-hide-in-a-web-full-of-casino-garbage
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'zzyud.com'
            - '11168833.com'
            - '11170011.com'
            - '1862.cc'
            - '312zym001.cc'
            - '80074.cc'
    condition: selection
falsepositives:
    - User browsing gambling sites (policy violation, not necessarily compromise)
level: medium
tags:
    - attack.command_and_control
    - attack.t1071.004

// Hunt: NightEagle GhostContainer/Neo-reGeorg activity on Exchange servers + PeckBirdy infrastructure contact
// Covers: webshell process spawning, suspicious w3wp children, IOC network contact, DNS to casino C2
let KnownHashes = dynamic(["1dcafb7f8448683281106b06dd22409a","1f3034b706c78b35d8e34044e68c693a","3ecd1cd627d0340c92901a478a7caad8","4aa9fb1bf9223dfcdac920759bc7a3c7","138614a0dd4017855bc379233685364a6f955ad9","99cb8000ab5e4625a2a23834dde681c25eee9095bb4fa751458bcc0cec6e194f"]);
let PeckBirdyDomains = dynamic(["zzyud.com","11168833.com","11170011.com","1862.cc","312zym001.cc","80074.cc"]);
let PeckBirdyIPs = dynamic(["146.103.91.133","157.185.143.150"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","net.exe","whoami.exe","nltest.exe","rundll32.exe","cscript.exe","wscript.exe"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName =~ "w3wp.exe"
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, HuntType="Exchange w3wp suspicious child process"
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where MD5 in~ (KnownHashes) or SHA1 in~ (KnownHashes) or SHA256 in~ (KnownHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, HuntType="GhostContainer file hash match"
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where FolderPath has_any ("FrontEnd\\HttpProxy","inetpub\\wwwroot","ClientAccess")
    | where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx"
    | where ActionType == "FileCreated"
    | project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, HuntType="Possible webshell drop in Exchange web directory"
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (PeckBirdyIPs) or RemoteUrl has_any (PeckBirdyDomains)
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, HuntType="PeckBirdy infrastructure contact"
),
(
    DeviceEvents
    | where TimeGenerated > ago(14d)
    | where ActionType == "DnsQueryResponse"
    | where Name has_any (PeckBirdyDomains)
    | project TimeGenerated, DeviceName, Name, HuntType="PeckBirdy DNS resolution"
)
| sort by TimeGenerated desc

<#
.SYNOPSIS
    NightEagle GhostContainer + PeckBirdy IOC Hunt Script
.DESCRIPTION
    Checks Exchange/IIS servers for GhostContainer webshell artifacts, known file hashes,
    suspicious ASPX drops, Neo-reGeorg tunnel indicators, and PeckBirdy infrastructure connections.
    Run elevated. Intended for Exchange servers and domain-joined endpoints.
#>

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[+] Security Arsenal IOC Hunt - NightEagle / PeckBirdy - $(Get-Date -Format 'yyyy-MM-dd HH:mm')" -ForegroundColor Cyan

# --- 1. Hash sweep against known GhostContainer samples ---
$knownHashes = @(
    "1dcafb7f8448683281106b06dd22409a",
    "1f3034b706c78b35d8e34044e68c693a",
    "3ecd1cd627d0340c92901a478a7caad8",
    "4aa9fb1bf9223dfcdac920759bc7a3c7",
    "138614a0dd4017855bc379233685364a6f955ad9",
    "99cb8000ab5e4625a2a23834dde681c25eee9095bb4fa751458bcc0cec6e194f"
)

$webRoots = @(
    "$env:SystemDrive\inetpub\wwwroot",
    "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy",
    "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess"
)

Write-Host "[*] Sweeping web roots for known GhostContainer hashes..." -ForegroundColor Yellow
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.ashx,*.asmx,*.dll -File | ForEach-Object {
            $md5 = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
            $sha1 = (Get-FileHash -Path $_.FullName -Algorithm SHA1).Hash.ToLower()
            $sha256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
            if ($knownHashes -contains $md5 -or $knownHashes -contains $sha1 -or $knownHashes -contains $sha256) {
                $report += [PSCustomObject]@{Severity="CRITICAL"; Finding="GhostContainer hash match"; Path=$_.FullName; Hash=$sha256}
            }
        }
    }
}

# --- 2. Recently created/modified ASPX files (potential Neo-reGeorg webshells) ---
Write-Host "[*] Checking for webshells modified in last 30 days..." -ForegroundColor Yellow
$cutoff = (Get-Date).AddDays(-30)
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx -File |
            Where-Object { $_.LastWriteTime -gt $cutoff } | ForEach-Object {
                $report += [PSCustomObject]@{Severity="HIGH"; Finding="Recent script file in web root"; Path=$_.FullName; Hash=$_.LastWriteTime}
            }
    }
}

# --- 3. Neo-reGeorg signature content check ---
Write-Host "[*] Scanning ASPX files for Neo-reGeorg tunnel signatures..." -ForegroundColor Yellow
$reGeorgPatterns = @("reGeorg","neoreg","Socket","Forwarding","Georg says")
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx -File | ForEach-Object {
            $content = Get-Content $_.FullName -Raw
            foreach ($pattern in $reGeorgPatterns) {
                if ($content -match $pattern) {
                    $report += [PSCustomObject]@{Severity="CRITICAL"; Finding="Neo-reGeorg signature '$pattern' detected"; Path=$_.FullName; Hash="N/A"}
                    break
                }
            }
        }
    }
}

# --- 4. Exchange patch check for CVE-2020-0688 exposure ---
Write-Host "[*] Checking Exchange build for CVE-2020-0688 exposure..." -ForegroundColor Yellow
$exSetup = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup"
if ($exSetup) {
    $report += [PSCustomObject]@{Severity="INFO"; Finding="Exchange detected - verify Feb 2020+ CU applied for CVE-2020-0688"; Path="HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup"; Hash="Build: $($exSetup.MsiProductVersion)"}
}

# --- 5. Network connections to PeckBirdy IPs ---
Write-Host "[*] Checking active connections to PeckBirdy infrastructure..." -ForegroundColor Yellow
$peckIPs = @("146.103.91.133","157.185.143.150")
Get-NetTCPConnection | Where-Object { $peckIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [PSCustomObject]@{Severity="HIGH"; Finding="Connection to PeckBirdy IP $($_.RemoteAddress):$($_.RemotePort)"; Path=$proc.Path; Hash="PID $($_.OwningProcess)"}
}

# --- 6. DNS cache check for PeckBirdy domains ---
Write-Host "[*] Checking DNS cache for PeckBirdy domains..." -ForegroundColor Yellow
$peckDomains = @("zzyud.com","11168833.com","11170011.com","1862.cc","312zym001.cc","80074.cc")
Get-DnsClientCache | Where-Object { $d = $_.Entry; $peckDomains | Where-Object { $d -like "*$_*" } } | ForEach-Object {
    $report += [PSCustomObject]@{Severity="MEDIUM"; Finding="PeckBirdy domain in DNS cache: $($_.Entry)"; Path=$_.Data; Hash="N/A"}
}

# --- 7. Suspicious scheduled tasks (persistence) ---
Write-Host "[*] Checking scheduled tasks for suspicious persistence..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } | ForEach-Object {
    $action = $_.Actions.Execute
    if ($action -match "powershell|cmd|wscript|cscript|rundll32|regsvr32") {
        $report += [PSCustomObject]@{Severity="MEDIUM"; Finding="Non-Microsoft scheduled task: $($_.TaskName)"; Path=$action; Hash=$_.TaskPath}
    }
}

# --- Output ---
Write-Host "`n========== HUNT RESULTS ==========" -ForegroundColor Cyan
if ($report.Count -eq 0) {
    Write-Host "[+] No indicators found. Host appears clean." -ForegroundColor Green
} else {
    $report | Sort-Object Severity | Format-Table -AutoSize
    $report | Export-Csv -Path ".\nighteagle_peckbirdy_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) findings exported to CSV. Escalate CRITICAL/HIGH findings to IR immediately." -ForegroundColor Red
}