🇨🇳

Earth Krahang

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 34

Countries highlighted in red

Argentina Bangladesh Plurinational State of Bolivia Brazil Ecuador Egypt Hungary Indonesia Israel India Jordan Kyrgyzstan Cambodia Republic of Korea Kazakhstan Sri Lanka Morocco Myanmar Mexico Malaysia Nigeria Oman Peru Pakistan Romania Rwanda Saudi Arabia Thailand Tajikistan Turkey United States Uzbekistan Vietnam South Africa

Sectors Targeted

Telecommunications Retail Healthcare NGOs Shipping and Logistics Government IT Financial Media Manufacturing Hospitality Defense Education

Details

Origin 🇨🇳 CN

Last Updated 23 Mar 2024

MITRE ATT&CK 10

T1027 T1036 T1047 T1055 T1059.001 T1064 T1071 T1078 T1204 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Earth Krahang Trend Micro

Observed Target Countries 37

Based on ETDA data — countries highlighted in red

Argentina Bangladesh Bolivia Brazil Cambodia Ecuador Egypt Hungary India Indonesia Israel Jordan Kazakhstan Kyrgyzstan Laos Malaysia Mexico Morocco Myanmar Nigeria Oman Pakistan Peru Romania Rwanda Saudi Arabia South Africa South Korea Sri Lanka Tajikistan Thailand Turkey UAE UK USA Uzbekistan Vietnam

Description

(Trend Micro) Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa. The threat actor exploits public-facing servers and sends spear phishing emails to deliver previously unseen backdoors. Our research allowed us to identify the campaign’s multiple connections with a China-nexus threat actor we track as Earth Lusca. However, since the campaign employs independent infrastructure and unique backdoors, we believe it to be a separate intrusion set that we named Earth Krahang.

Tools Used 5

Cobalt Strike DinodasRAT PlugX Reshell ShadowPad Winnti

Reports & References 1

https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html

ETDA Profile

Earth Krahang

Origin

China

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗