Loading threat actor…
CL-STA-0046 is a suspected China-linked threat actor associated with the use of EarthWorm, an open-source SOCKS5 tunneling and port-forwarding utility commonly used to support covert communications and internal pivoting. Public reporting links the cluster to tooling overlap with other China-linked intrusion sets, including APT41 and Volt Typhoon, but the available information does not establish that these are the same actor. High-confidence reporting specifically ties CL-STA-0046 to use of EarthWorm in prior operations. Based on the observed tooling association, the actor demonstrates post-compromise tradecraft consistent with stealthy network tunneling, proxying, and support for lateral movement inside victim environments. Available information is insufficient to confidently characterize specific victim sectors, countries targeted, sub-groups, or a fuller intrusion lifecycle beyond this tooling association.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.