NightEagle APT GhostContainer Exchange Backdoor + AMOS macOS Stealer ClickFix Campaign: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Two pulses published to AlienVault OTX on 2026-09-16 paint a converging picture: credential theft is being industrialized at both ends of the enterprise spectrum — server-side via APT-grade Exchange compromise, and endpoint-side via commodity macOS infostealers.

Pulse 1 — NightEagle (APT-Q-95) targeting Russian enterprises: Active since 2023 and previously focused on Asian organizations, NightEagle has pivoted to Russian companies. The intrusion chain begins with compromised VPN credentials — notably harvested from Cloudflare WARP tunnels and European infrastructure providers — suggesting upstream credential markets or prior infostealer infections feeding initial access. Once inside, operators deploy the GhostContainer backdoor on Microsoft Exchange servers, exploiting CVE-2020-0688 (Exchange validation key RCE) and referencing CVE-2019-0708 (BlueKeep) in their toolkit. Neo-reGeorg tunneling is used to pivot through the perimeter into Active Directory. The objective is persistent espionage-grade access to mail infrastructure and identity systems.

Pulse 2 — Atomic macOS (AMOS) Stealer: AMOS, sold as malware-as-a-service since April 2024, continues large-scale distribution via ClickFix social engineering (fake browser update / CAPTCHA 'paste this command' lures), malicious ads, and cracked software sites. AMOS harvests system information, Keychain and browser credentials, session cookies, and cryptocurrency wallets — precisely the kind of credential corpus that ends up brokered on dark web markets and later weaponized by groups like NightEagle for VPN access.

The strategic takeaway: these are two stages of the same economy. Infostealer logs → credential markets → APT initial access → Exchange/AD compromise. Defenders must treat them as a connected kill chain, not isolated incidents.

Threat Actor / Malware Profile

NightEagle / APT-Q-95 / GhostContainer

Distribution / Initial Access: Valid VPN accounts — compromised credentials traced to Cloudflare WARP tunnel endpoints and European ISP/VPS infrastructure. No phishing required; access is purchased or harvested.
Exploitation: CVE-2020-0688 (Microsoft Exchange static validation key deserialization RCE) for server-side code execution; BlueKeep (CVE-2019-0708) references suggest RDP exploitation capability against legacy estates.
Payload Behavior: GhostContainer is an Exchange-hosted backdoor (IIS module / webshell-class implant) enabling command execution, file staging, and mailbox access under the Exchange service context.
C2 / Tunneling: Neo-reGeorg — an HTTP(S) tunneling webshell that encapsulates internal network traffic inside legitimate-looking web requests to the compromised Exchange server, allowing the actor to reach AD and internal segments without direct outbound C2.
Persistence: Implant resides within Exchange/IIS; VPN valid accounts provide redundant re-entry. Expect webshell file drops under Exchange virtual directories and anomalous w3wp.exe child processes.
Anti-Analysis: Blending C2 into Exchange web traffic; living off valid credentials to bypass perimeter and EDR behavioral triggers.

Atomic macOS Stealer (AMOS)

Distribution: ClickFix campaigns (fake update dialogs instructing users to paste base64 shell commands into Terminal), malvertising, SEO-poisoned cracked software sites. Delivery domains observed include grove-89.com, getmacouscloud.com, and ferncore13.com.
Payload Behavior: Exfiltrates system info, Keychain/login credentials, browser cookies and saved passwords (Chrome, Firefox, Safari), Telegram session data, and cryptocurrency wallet files (Exodus, Electrum, MetaMask extensions).
C2 Communication: HTTPS POST of staged archives to actor-controlled panels; domains rotate frequently.
Persistence: Varies by build — LaunchAgents/LaunchDaemons plist drops and login items are common.
Anti-Analysis: Base64-obfuscated AppleScript/shell stagers, gatekeeper bypass via unsigned ad-hoc binaries, user-assisted execution that defeats notarization controls.

IOC Analysis

The pulses contain three indicator classes, each requiring different operational handling:

CVEs (CVE-2019-0708, CVE-2020-0688): Not blockable — these are patch-audit triggers. Any internet-facing Exchange or RDP host unpatched against these is an assumed-compromise candidate. Feed to your vulnerability scanner as priority checks.
File hashes (MD5/SHA1/SHA256): GhostContainer samples and AMOS binaries. Load into EDR blocklists and retro-hunt. Note AMOS rotates builds aggressively — hashes have short half-lives; pair with behavioral detection.
Domains (grove-89.com, getmacouscloud.com, ferncore13.com): AMOS distribution/C2 infrastructure. Block at DNS sinkhole and web proxy; query passive DNS for historical resolution to identify patient-zero endpoints.

Tooling: OTX pulses can be ingested directly via the OTX DirectConnect API into MISP, ThreatConnect, or Microsoft Sentinel (OTX connector). Use otx-cli/pyotx for scripted pulls, CyberChef for decoding ClickFix base64 stagers, and reGeorg-style tunnel detection via IIS log analysis for abnormal long-lived HTTP sessions with tunneled payload entropy.

Detection Engineering

YAML

---
title: GhostContainer / Neo-reGeorg Exchange Webshell Tunnel Activity
description: Detects IIS worker process spawning command shells or suspicious tunneling behavior consistent with NightEagle GhostContainer and Neo-reGeorg deployment on Exchange servers
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
  service: iis
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\whoami.exe'
      - '\csc.exe'
      - '\vbc.exe'
  filter_ums:
    CommandLine|contains: 'MSExchange' # reduce noise from legitimate health checks where applicable
  condition: selection_parent and selection_child and not filter_ums
falsepositives:
  - Exchange cumulative updates
  - Legitimate admin scripts (rare)
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
date: 2026/09/16
---
title: AMOS ClickFix Base64 Terminal Stager Execution (macOS)
description: Detects curl-piped or base64-decoded shell execution patterns used by ClickFix campaigns delivering Atomic macOS Stealer
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: macos
detection:
  selection_curl:
    Image|endswith: '/curl'
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
  selection_decode:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 --decode'
      - 'openssl enc -d'
  selection_domains:
    CommandLine|contains:
      - 'grove-89.com'
      - 'getmacouscloud.com'
      - 'ferncore13.com'
  condition: selection_curl or selection_decode or selection_domains
falsepositives:
  - Developer homebrew installations
  - IT provisioning scripts
level: high
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1204
  - attack.defense_evasion
  - attack.t1027
date: 2026/09/16
---
title: AMOS Credential and Crypto Wallet Collection Behavior
description: Detects rapid file access to Keychain, browser credential stores, and cryptocurrency wallet paths characteristic of AMOS stealer staging
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: file_event
  product: macos
detection:
  selection_paths:
    TargetFilename|contains:
      - '/Library/Keychains/login.keychain'
      - '/Cookies/Cookies.binarycookies'
      - '/Google/Chrome/Default/Login Data'
      - '/BraveSoftware/Brave-Browser/Default/Login Data'
      - '/Exodus/exodus.wallet'
      - '/electrum/wallets'
      - '/.config/MetaMask'
      - '/Telegram Desktop/tdata'
  filter_browsers:
    Image|endswith:
      - '/Google Chrome'
      - '/Safari'
      - '/firefox'
  condition: selection_paths and not filter_browsers
falsepositives:
  - Backup agents
  - MDM inventory tools
level: critical
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1005
date: 2026/09/16

KQL — Microsoft Sentinel / Defender

// Hunt: AMOS C2/distribution domains + Exchange webshell child processes
let amos_domains = dynamic(["grove-89.com","getmacouscloud.com","ferncore13.com"]);
let amos_hashes = dynamic([
 "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c",
 "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a",
 "a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9",
 "6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620",
 "4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where RemoteUrl has_any (amos_domains)
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType),
  (DeviceFileEvents
   | where SHA256 has_any (amos_hashes)
   | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName),
  (DeviceProcessEvents
   | where InitiatingProcessFileName =~ "w3wp.exe"
   | where FileName in~ ("cmd.exe","powershell.exe","net.exe","nltest.exe","whoami.exe")
   | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName),
  (DeviceProcessEvents
   | where FileName =~ "curl" and ProcessCommandLine has_any ("| sh","| bash","| zsh")
      or ProcessCommandLine has "base64 -d"
   | where DeviceOSType contains "macOS"
   | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName)
| order by TimeGenerated desc

PowerShell

# NightEagle / GhostContainer IOC hunt — Windows & Exchange servers
$hashes = @(
  "1dcafb7f8448683281106b06dd22409a",
  "1f3034b706c78b35d8e34044e68c693a",
  "3ecd1cd627d0340c92901a478a7caad8",
  "4aa9fb1bf9223dfcdac920759bc7a3c7"
)

Write-Host "[*] Hunting GhostContainer hash IOCs in Exchange web roots..." -ForegroundColor Cyan
$paths = @(
  "C:\inetpub\wwwroot",
  "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy",
  "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess"
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -File -Include *.aspx,*.ashx,*.asmx,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
      $h = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
      if ($hashes -contains $h) { Write-Host "[!] MATCH: $($_.FullName) -> $h" -ForegroundColor Red }
    }
    # Recently modified webshell-class files (last 30 days)
    Get-ChildItem $p -Recurse -File -Include *.aspx,*.ashx -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
      ForEach-Object { Write-Host "[?] Recently modified: $($_.FullName) ($($_.LastWriteTime))" -ForegroundColor Yellow }
  }
}

Write-Host "[*] Checking Exchange patch level for CVE-2020-0688..." -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.HotFixID -match "KB4536987" } | Format-Table HotFixID, InstalledOn

Write-Host "[*] Anomalous w3wp child processes (Neo-reGeorg indicator)..." -ForegroundColor Cyan
Get-CimInstance Win32_Process | Where-Object {
  $_.Name -in "cmd.exe","powershell.exe","net.exe","whoami.exe" -and
  (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).Name -eq "w3wp"
} | Select-Object ProcessId, Name, CommandLine, ParentProcessId

Write-Host "[*] VPN account logon anomalies (Event 4624 Type 3/10 from unusual sources)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 2000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "Logon Type:\s+(3|10)" } |
  Group-Object { ($_.Message -split "`n") -match "Account Name" } |
  Sort-Object Count -Descending | Select-Object -First 10 Count, Name

Response Priorities

Immediate (0–4 hours)

Block grove-89.com, getmacouscloud.com, ferncore13.com at DNS, proxy, and email gateways; push SHA256/MD5 IOCs to EDR blocklists.
Audit all internet-facing Exchange servers for CVE-2020-0688 patch status and inspect web roots for unexpected .aspx/.ashx files (GhostContainer / Neo-reGeorg).
Retro-hunt endpoint telemetry for ClickFix execution patterns (curl ... | sh, base64 -d in Terminal) on macOS fleets.
Alert on any w3wp.exe → cmd/powershell process chains in real time.

Within 24 Hours

Credential exposure triage: Both campaigns are credential-theft engines. Force password resets and MFA re-enrollment for any user whose device matched AMOS IOCs; revoke active sessions, refresh tokens, and Keychain-stored service credentials.
Audit VPN (including Cloudflare WARP) authentication logs for logins from European infrastructure providers inconsistent with user geography; disable any account with anomalous source ASN.
Rotate Exchange service accounts, machine keys, and any AD credentials touched from mail-server contexts.
Check dark web credential marketplaces / stealer-log aggregators for your corporate domains — AMOS logs surface for sale within days.

Within 1 Week

Architecture hardening: Remove direct internet exposure of Exchange where possible; enforce hybrid modern auth; deploy IIS request filtering to block tunneling-style long-poll patterns.
Enforce macOS Gatekeeper/MDM policies blocking unsigned binaries and restricting Terminal access for standard users; deploy network-layer detection for stealer panel beaconing.
Migrate VPN access to certificate-bound MFA with device posture checks — credentials alone must never suffice.
Deploy the Sigma/KQL detections above into production monitoring and validate with purple-team simulation of ClickFix and webshell-tunnel tradecraft.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

NightEagle APT GhostContainer Exchange Backdoor + AMOS macOS Stealer ClickFix Campaign: OTX Pulse Analysis — Enterprise Detection Pack