- Category
- State · Attributed to a state or working for one.
- Origin
- United States(high confidence)contested
- Sponsor
- US
- Motivation
- Espionage
- Seen
- 2023
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0859 · nighteagle
United StatesWhat it is
NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated techniques, 0 days, and specialized detection avoiding malware. The threat actor seems to have access to significant funding, with dedicated infrastructure, and focuses on low-noise, low-impact intelligence gathering operations. NightEagle is identified as a North-American, state-sponsored or affiliated group that has been active since at least 2023.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- QiAnXin
- APT-Q-95
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)United States
- ThreatActor.info (Malpedia et al.)United States
Chinese and Russian sources
- QiAnXin RedDrip · 2025-07QiAnXin reported a North America-based actor exploiting Exchange zero-days against Chinese AI, semiconductor and military-industrial targets.United States (suspected) · medium (claimant)
Targets
- Countries
- China
- Sectors
- Government, Government, Administration, Military, Private Sector, Technology
Tools
The tools and malware families the sources tie to it.
- China Chopper
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de