Earth Longzhi

Earth Longzhi is a China-linked cyberespionage threat actor assessed to be a subgroup of APT41. Reporting describes it as a newly named APT41 subgroup active since at least 2020, with campaigns observed from 2020 to 2022 and later infrastructure/tooling overlaps noted in 2023-2025 activity. It has primarily targeted organizations in Taiwan and across the Asia-Pacific region, including government, infrastructure, healthcare, academia, banking, defense, aviation, insurance, and urban development sectors; later reporting also links overlapping infrastructure to intrusions against Southeast Asian government entities. Researchers and vendors explicitly describe Earth Longzhi as a Chinese subgroup or sub-cluster of APT41. Observed tradecraft includes spear-phishing with password-protected archives or download links, exploitation of publicly exposed applications, extensive DLL sideloading, customized Cobalt Strike loaders, process injection, parent-process masquerading, anti-hooking via in-memory ntdll.dll restoration, named-pipe-based decryption, scheduled-task persistence, and UAC bypass using the COM object IElevatedFactoryServer. Reported custom loaders and tooling include Symatic loader, CroxLoader, BigpipeLoader, MultiPipeLoader, and OutLoader. Earth Longzhi also used an all-in-one post-exploitation tool with proxying, scanning, privilege-launching, timestamp modification, and SQL capabilities. For credential access and privilege escalation, reporting states the group reimplemented Mimikatz modules as standalone binaries, including functionality equivalent to sekurlsa::logonpasswords, lsadump::dcsync, lsadump::backupkeys with dpapi::chrome, and misc::memssp, and used PrintNightmare and PrintSpoofer. Defense evasion included Bring Your Own Vulnerable Driver techniques using RTCore64.sys (CVE-2019-16098) through tools named ProcBurner and AVBurner to terminate protected processes and unregister AV/EDR callbacks. Additional reporting links Earth Longzhi to BYOVD-based disabling of security products and creation of a high-privilege scheduled task disguised as Google Update. Attribution to APT41 is supported in the provided content by victimology, shared Cobalt Strike metadata, code similarities with GroupCC, and overlapping TTPs, including use of a Python Fastly CDN technique to conceal command-and-control infrastructure. The content also notes that some later incidents only overlap with Earth Longzhi infrastructure or techniques, and that precise attribution can be complicated by tool and infrastructure sharing among Chinese threat actors. Known related names directly mentioned in the content are APT41 and GroupCC.