Earth Minotaur

Earth Minotaur is a China-aligned threat actor associated with surveillance-focused operations against Tibetan and Uyghur communities. The group is linked to the MOONSHINE exploit kit and the DarkNimbus backdoor, also referred to as DarkNights in some reporting. Activity associated with this cluster has been observed since at least 2019, with DarkNimbus development assessed as active since 2018 and MOONSHINE first identified in attacks against Tibetan targets in 2019. Earth Minotaur primarily uses social engineering delivered through instant messaging applications to entice victims into opening malicious links. MOONSHINE supports masqueraded links, selective exploit delivery based on victim application and browser versions, and redirection back to benign content after exploitation. The framework has targeted vulnerable Chromium-based browsers and embedded browser components in Android applications, including exploitation of multiple known browser vulnerabilities and likely support for exploitation of WeChat-related browser components. Observed lures have impersonated government announcements, public-health news, religion-related content, travel information, and media relevant to Tibetan and Uyghur audiences. Successful compromise has led to deployment of DarkNimbus, a cross-platform backdoor with Android and Windows variants. The Android variant supports extensive surveillance and collection, including device profiling, contacts, messages, call records, location data, clipboard contents, files, screenshots, photos, recordings, and theft of communications from messaging applications through abuse of Android accessibility features. The Windows variant supports host profiling, installed software enumeration, file theft, browsing-history theft, screenshots, keylogging, clipboard theft, shell execution, and browser credential theft. DarkNimbus uses encrypted command-and-control channels and supports file transfer operations. Earth Minotaur has also been linked to DKnife, a modular adversary-in-the-middle and gateway-monitoring framework deployed on routers and edge devices. DKnife enables deep packet inspection, DNS hijacking, credential harvesting from email traffic, malware delivery through hijacked binary downloads and Android application updates, reverse proxying, packet forwarding, and exfiltration from Chinese applications. Reported payload delivery through this ecosystem has included DarkNimbus and ShadowPad. The actor is assessed as Chinese in origin. Reporting also notes ecosystem overlap with other China-aligned operators, particularly TheWizards, which has used DarkNimbus but is treated as a distinct intrusion set. MOONSHINE is assessed to remain under active development and may be shared across multiple Chinese-aligned operators, but Earth Minotaur is the cluster directly associated with its use against Tibetan and Uyghur targets.