Loading threat actor…
Earth Krahang is a Chinese-nexus cyberespionage intrusion set active since at least early 2022. It primarily targets government entities, particularly foreign-affairs-related organizations, with a strong operational focus on Southeast Asia and additional activity affecting organizations in Europe, the Americas, and Africa. Telecommunications providers, postal organizations, media firms, and financial institutions have also been targeted. Reporting has identified approximately 70 confirmed victims in 23 countries and 116 targeted entities across 35 countries. Earth Krahang obtains access through spear-phishing and exploitation of internet-facing servers, including Oracle Web Applications Desktop Integrator and Openfire vulnerabilities. It abuses compromised government web and email infrastructure to host payloads, proxy attack traffic, conduct reconnaissance, and distribute phishing messages to other government targets. The actor has deployed RESHELL, XDealer/DinodasRAT (including its Linux Linodas variant), Cobalt Strike, PlugX, and ShadowPad, and uses SoftEther VPN to retain access to compromised networks. Post-compromise activity includes credential dumping, password spraying against webmail services, theft and use of authenticated web-session cookies, mailbox collection and exfiltration, network and vulnerability scanning, remote execution, lateral movement, and privilege escalation on Windows and Linux. Earth Krahang uses scheduled tasks, services, remote desktop enablement, web shells, DLL side-loading, masquerading, tunneling, and modified or replaced system utilities to establish persistence, evade detection, and conceal artifacts. The PONDSNAKE campaign has been assessed with medium-to-high confidence as attributable to Earth Krahang. The group has notable operational and tooling overlaps with Earth Lusca/RedHotel and has been linked in reporting to the Chinese contractor I-Soon.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
62 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
9 malware families Mallory has associated with this actor across public reporting.
4 additional families tracked in Mallory.
5 CVEs Mallory has associated with this actor across public reporting. 5 of them are exploited in the wild (not necessarily by this actor).
126 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.