← Actors

NightEagle

Intel Library

NightEagle

Threat actorUSEspionage1 report from 1 vendor· last reported 2026-09-16

NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated techniques, 0 days, and specialized detection avoiding malware. The threat actor seems to have access to significant funding, with dedicated infrastructure, and focuses on low-noise, low-impact intelligence gathering operations. NightEagle is identified as a North-American, state-sponsored or affiliated group that has been active since at least 2023.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

VendorName
OSINTAPT-Q-95

Targeting

Sectors: Military, Government, Private Sector, Military, Government, Administration, Technology

Victim countries: China

MITRE ATT&CK techniques (5)

Indicators of compromise

domainASP.NET
domaingithub.com
ipv410.0.12.101
hash1dcafb7f8448683281106b06dd22409a
hash1f3034b706c78b35d8e34044e68c693a
hash3ecd1cd627d0340c92901a478a7caad8
hash631fb131a56caf4ca0f287ed73e876ab
hash4aa9fb1bf9223dfcdac920759bc7a3c7
domainhttps://github.com/mirror-js/mirror-js
domainhttps://github.com/browserthemes/resourcepack

Top 10 by how many reports mention them.

Report timeline

Every report in the Global Intel Library that names NightEagle, newest first. Open any report to see the full analysis with provenance.

  1. Kaspersky2026-09-16
    NightEagle targets Russian companies
    T1055T1071.001T1574.002T1053.005T1059.001
    original

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to NightEagle. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (3)

Open-source reports about this actor collected from MISP Galaxy.