Loading story…
Trend Micro reported that the threat actor Earth Preta updated its intrusion tradecraft to improve stealth and persistence during targeted operations. The group was observed refining how it gains access, moves within victim environments, and maintains long-term footholds while reducing the chances of detection by defenders.
The activity highlights a continued evolution in attacker operational security, with Earth Preta emphasizing quieter post-compromise behavior and more covert techniques across the attack chain. For CISOs, the report underscores the need to strengthen monitoring for subtle lateral movement, persistence mechanisms, and other low-noise indicators associated with advanced targeted intrusions.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro released research detailing updated stealthy strategies used by the Earth Preta threat actor. The reference indicates public disclosure of new technical findings about the group's activity.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro and TrendAI reported that **Earth Estries**, a China-linked espionage group active since at least 2020, compromised more than 20 organizations across the United States, Asia-Pacific, the Middle East, South Africa, and Southeast Asia. The intrusions primarily targeted **government, telecommunications, and technology-sector organizations**, with researchers linking the activity to prolonged campaigns against telecom providers and government networks. The group has been associated with overlaps in tradecraft and tooling seen in **FamousSparrow** and other Chinese APT activity, though researchers said some malware and infrastructure may reflect shared ecosystem resources rather than exclusive ownership. Researchers said Earth Estries gained initial access by exploiting public-facing systems, including **Ivanti Connect Secure**, **Fortinet FortiClient EMS** SQL injection flaws, **Sophos Firewall** code injection bugs, and the **Microsoft Exchange ProxyLogon** chain. After breaching servers and administrative accounts, the actors used **PowerShell downgrade attacks**, **DLL sideloading**, **living-off-the-land binaries**, **Cobalt Strike**, **SMB**, and **WMIC** for persistence and lateral movement, while deploying backdoors and implants such as **Zingdoor**, **HemiGate**, **TrillClient**, **GHOSTSPIDER**, **SNAPPYBEE**, **DEMODEX**, and **MASOL RAT**. Stolen documents and browser data were exfiltrated through public file-sharing services and SMTP, and the operators masked command-and-control traffic with techniques including **Fastly CDN** fronting and infrastructure patterns consistent with DNS tunneling.
Aug 21, 2026
Earth Baku, a cluster linked to **APT41**, has expanded a long-running cyberespionage campaign against government and enterprise targets from the Indo-Pacific into **Europe** and the **Middle East and Africa**, using a steadily evolving malware arsenal and multiple intrusion paths. Trend Micro reported the group has compromised organizations in sectors including airlines, automotive, infrastructure, media, publishing, IT, and hardware, with activity tied to **SQL injection** on public-facing applications, exploitation of **Microsoft Exchange ProxyLogon** `CVE-2021-26855`, IIS server abuse, and web shells including **China Chopper** and **Godzilla**. Earlier reporting also described possible email-delivered LNK downloader chains and continued operational activity after public law-enforcement scrutiny. The operators have introduced **StealthReacher**, an upgraded loader derived from **StealthVector**, to deploy **SneakCross**, a modular backdoor assessed as the successor to **ScrambleCross** and earlier **Crosswalk**-related tooling. Across reporting, the group was observed using **Cobalt Strike Beacon**, **ShadowPad**, **Natwalk**, **RBRAT**, **Errorroot**, **HIGHNOON**, and other loaders and backdoors, while relying on stealth techniques such as ETW disabling, process and DLL hollowing, module stomping, CFG bypass, early-bird injection, and certificate bypass. Researchers also said Earth Baku hid command-and-control through CDN services, **Cloudflare Workers**, and **Google services**, and supported persistence, tunneling, and exfiltration with customized **iox**, **Rakshasa**, **Tailscale**, and **MEGAcmd**.
Aug 15, 2026
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026