🇨🇳

REF7707

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

Earth Alux

Target Countries 5

Countries highlighted in red

Brazil Malaysia Philippines Thailand Province of China Taiwan

Sectors Targeted

Technology Telecommunications Retail Shipping and Logistics Government IT Manufacturing

Details

Origin 🇨🇳 CN

Last Updated 05 Jan 2026

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Earth Alux Trend Micro

Observed Target Countries 5

Based on ETDA data — countries highlighted in red

Brazil Malaysia Philippines Taiwan Thailand

Description

(Trend Micro) The Earth Alux APT group’s schemes and tactics have been uncloaked through our relentless monitoring and investigation efforts. The China-linked intrusion set is actively launching cyberespionage attacks against the government, technology, logistics, manufacturing, telecommunications, IT services, and retail sectors. The first sighting of its activity was in the second quarter of 2023; back then, it was predominantly observed in the APAC region. Around the middle of 2024, it was also spotted in Latin America. Earth Alux has also been observed to conduct regular tests for some of its toolsets to ensure stealth and longevity in the target environment.

Tools Used 7

Cobalt Strike Godzilla MASQLOADER RAILLOAD RAILSETTER RSBINJECT VARGEIT

Reports & References 1

https://www.trendmicro.com/en_us/research/25/c/the-espionage-toolkit-of-earth-alux.html

ETDA Profile

Earth Alux

Origin

China

First Seen 2023

Motivation

Information theft and espionage

View on ETDA APT Groups ↗