Earth Naga
Earth Naga is a China-aligned advanced persistent threat group. The provided content directly links it to targeting government agencies in Southeast Asia and describes it as part of a collaborative operating model with another China-aligned actor, Earth Estries. Trend Micro reported a "Premier Pass-as-a-Service" relationship in which Earth Estries acts as an access broker and passes initial access to Earth Naga for follow-on exploitation; this partnership was assessed to have existed since at least late 2023. The content also states that this model reduces time spent on reconnaissance, initial exploitation, and lateral movement and is likely restricted to a small circle of threat actors. Earth Naga is also noted as a user of Draculoader, a generic shellcode loader that has been used by Earth Estries and Earth Naga. Known alias in the provided content: earth_naga.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actor receiving initial access from Earth Estries for subsequent exploitation activity.
APT group referenced as using Draculoader and historically targeting government agencies in Southeast Asia and elsewhere.
China-aligned cyberespionage actor described collaborating with another China-aligned group via access-brokering (‘pass-as-a-service’) to enable continued exploitation; targets include government and telecommunications, with recent focus on retail and government-related orgs in APAC.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.