Loading story…
Researchers linked the Linux backdoor Linodas to the China-nexus espionage activity publicly associated with Earth Krahang, expanding understanding of a campaign that has targeted government entities across at least 35 countries. Trend Micro reported that the group compromised public-facing servers and used spear-phishing, stolen email accounts, and trusted government infrastructure to pivot into other ministries and agencies, with foreign affairs organizations heavily affected. The operation relied on custom malware including XDealer/DinodasRAT and RESHELL, alongside tools such as Cobalt Strike, PlugX, ShadowPad, SoftEther VPN, Mimikatz, and credential theft against Exchange and other mail services to support long-term intelligence collection.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Check Point reported the latest Linux DinodasRAT sample it analyzed, carrying the internal version string Linux_%s_%s_%u_V11, was first seen in November 2023.
During Operation Jacana, the attackers used a previously undocumented C++ backdoor that ESET named DinodasRAT, delivered via spearphishing emails themed around Guyanese public affairs.
ESET detected a targeted spearphishing-led cyberespionage intrusion in February 2023 against a governmental entity in Guyana and named it Operation Jacana.
Trend Micro reported that since 2023, Earth Krahang has shifted from using RESHELL to XDealer, also known as DinodasRAT, and has used both Windows and Linux variants.
Check Point reported a later Linux DinodasRAT sample with the internal version string Linux_%s_%s_%u_V10 was first seen in January 2023.
Trend Micro said the Earth Krahang intrusion set has targeted government entities worldwide since early 2022, focusing especially on Southeast Asia while also reaching Europe, the Americas, and Africa.
Check Point reported the earliest cited Linux DinodasRAT sample, tracked as Linodas, was first seen in the wild in July 2021 and carried the internal version string Linux_%s_%s_%u_V7.
Check Point analyzed Linodas as the Linux branch of DinodasRAT/XDealer and attributed its use to a Chinese-nexus espionage actor aligned with publicly reported Earth Krahang activity, noting Linux-specific development and a shared C2 with a Windows sample.
Trend Micro disclosed a long-running cyberespionage campaign it named Earth Krahang, linking it to about 70 confirmed victims across 23 countries and describing abuse of compromised government infrastructure and email accounts to target other governments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcetrendmicro.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Solar 4RAYS uncovered a long-running cyber-espionage campaign targeting at least four companies that provide services to Russian government organizations, identifying a previously unseen Golang backdoor dubbed **GoblinRAT**. The intrusions reportedly ran from at least October 2020 through 2023 and relied on highly stealthy, hands-on-keyboard activity on Linux systems. Investigators said the operators abused built-in Linux utilities, used unique persistence names on each host, masqueraded malicious processes as legitimate services such as **Zabbix**, **memcached**, `vmtoolsd`, `cron`, and Red Hat subscription components, and in some cases executed malware only in memory. The malware was also hidden as a malicious library loaded into `atop`, while command-and-control infrastructure used compromised legitimate websites and DDNS services.
Aug 15, 2026
China-linked threat actor **Earth Lusca** expanded its operations globally while continuing to concentrate on Southeast Asia, Central Asia, and the Balkans, according to Trend Micro. Researchers recovered and decrypted a previously unseen Linux backdoor dubbed **SprySOCKS** from the group’s delivery infrastructure, linking it to campaigns targeting government departments involved in foreign affairs as well as organizations in the technology and telecommunications sectors. Trend Micro said SprySOCKS appears to be a Linux adaptation of the open-source Windows backdoor **Trochilus**, with an interactive shell resembling **Linux Derusbi** and a command-and-control protocol similar to **RedLeaves RAT**. The malware uses a two-part architecture consisting of a loader and an encrypted main payload, and multiple version markers indicate it remains under active development. Investigators also observed Earth Lusca using **Cobalt Strike** for lateral movement and aggressively exploiting public-facing servers through server-side **N-day vulnerabilities** to gain access.
Jun 29, 2026
Trend Micro and TrendAI reported that **Earth Estries**, a China-linked espionage group active since at least 2020, compromised more than 20 organizations across the United States, Asia-Pacific, the Middle East, South Africa, and Southeast Asia. The intrusions primarily targeted **government, telecommunications, and technology-sector organizations**, with researchers linking the activity to prolonged campaigns against telecom providers and government networks. The group has been associated with overlaps in tradecraft and tooling seen in **FamousSparrow** and other Chinese APT activity, though researchers said some malware and infrastructure may reflect shared ecosystem resources rather than exclusive ownership. Researchers said Earth Estries gained initial access by exploiting public-facing systems, including **Ivanti Connect Secure**, **Fortinet FortiClient EMS** SQL injection flaws, **Sophos Firewall** code injection bugs, and the **Microsoft Exchange ProxyLogon** chain. After breaching servers and administrative accounts, the actors used **PowerShell downgrade attacks**, **DLL sideloading**, **living-off-the-land binaries**, **Cobalt Strike**, **SMB**, and **WMIC** for persistence and lateral movement, while deploying backdoors and implants such as **Zingdoor**, **HemiGate**, **TrillClient**, **GHOSTSPIDER**, **SNAPPYBEE**, **DEMODEX**, and **MASOL RAT**. Stolen documents and browser data were exfiltrated through public file-sharing services and SMTP, and the operators masked command-and-control traffic with techniques including **Fastly CDN** fronting and infrastructure patterns consistent with DNS tunneling.
Aug 21, 2026