Loading story…
Trend Micro and TrendAI reported that Earth Estries, a China-linked espionage group active since at least 2020, compromised more than 20 organizations across the United States, Asia-Pacific, the Middle East, South Africa, and Southeast Asia. The intrusions primarily targeted government, telecommunications, and technology-sector organizations, with researchers linking the activity to prolonged campaigns against telecom providers and government networks. The group has been associated with overlaps in tradecraft and tooling seen in FamousSparrow and other Chinese APT activity, though researchers said some malware and infrastructure may reflect shared ecosystem resources rather than exclusive ownership.
Researchers said Earth Estries gained initial access by exploiting public-facing systems, including Ivanti Connect Secure, Fortinet FortiClient EMS SQL injection flaws, Sophos Firewall code injection bugs, and the Microsoft Exchange ProxyLogon chain. After breaching servers and administrative accounts, the actors used PowerShell downgrade attacks, DLL sideloading, living-off-the-land binaries, Cobalt Strike, SMB, and WMIC for persistence and lateral movement, while deploying backdoors and implants such as Zingdoor, HemiGate, TrillClient, GHOSTSPIDER, SNAPPYBEE, DEMODEX, and MASOL RAT. Stolen documents and browser data were exfiltrated through public file-sharing services and SMTP, and the operators masked command-and-control traffic with techniques including Fastly CDN fronting and infrastructure patterns consistent with DNS tunneling.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
On August 14, 2026, TrendAI published a report describing Earth Estries as a Chinese APT tied to more than 20 compromises across telecom, government, and other sectors. The report introduced GHOSTSPIDER as a newly discovered backdoor and attributed Campaign Alpha and Campaign Beta to the group with high confidence.
TrendAI reported Earth Estries exploited Ivanti Connect Secure vulnerabilities CVE-2023-46805 and CVE-2024-21887, as well as Fortinet FortiClient EMS SQL injection vulnerability CVE-2023-48788. These flaws were used against public-facing servers for initial access.
TrendAI identified Campaign Alpha as attacks observed in October 2023 against the Taiwanese government and a chemical company. The campaign used C2 server 23.81.41[.]166, which exposed an open directory containing malicious tools and SNAPPYBEE samples.
On August 30, 2023, Trend Micro reported an ongoing cyberespionage campaign attributed to a newly named threat group, Earth Estries. The report described targeting of government and technology organizations across multiple countries and noted overlaps with FamousSparrow TTPs.
Trend Micro first encountered the Go-based Zingdoor HTTP backdoor in April 2023. The malware was disguised as mpclient.dll and executed through DLL sideloading with the Windows Defender binary MsSecEs.exe.
TrendAI reported that since 2023, Earth Estries has primarily targeted telecommunications companies, government entities, and related service providers. The campaign affected organizations across the US, Asia-Pacific, the Middle East, and South Africa.
Development logs for the Go-based Zingdoor backdoor indicated activity as early as June 2022. Trend Micro later tied Zingdoor to Earth Estries operations.
TrendAI reported Earth Estries exploited Sophos Firewall code injection vulnerability CVE-2022-3236 for initial access. The exploitation was described as part of the group's public-facing server compromise activity.
TrendAI reported Earth Estries exploited the Microsoft Exchange ProxyLogon vulnerability chain for initial access in some intrusions. The chain consists of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.
Trend Micro assessed Earth Estries as active since at least 2020, conducting cyberespionage operations. Later reporting also described long-term intrusions dating back to at least that year.
A MASOL RAT Linux sample linked to Earth Estries contained a PDB string indicating possible development as early as 2019. The malware was later reported as used against Linux devices in Southeast Asian government networks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcetrendmicro.com
Open sourcetrendmicro.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro and TrendAI reported that China-aligned espionage groups collaborated by passing live access to already-compromised networks between intrusion sets, a model Trend calls **"Premier Pass-as-a-Service."** In one cited case, **Earth Estries** breached a Southeast Asian government environment, deployed **CrowDoor** and related tooling, and then enabled follow-on activity tied to **Earth Naga**—also tracked as **Flax Typhoon**, **RedJuliett**, or **Ethereal Panda**—including **ShadowPad** infrastructure. The reporting says this approach differs from traditional initial access brokerage because downstream operators appear to receive direct access to victim assets rather than just stolen credentials or footholds. The activity aligns with separate reporting that **RedJuliett** intensified cyber espionage against Taiwanese organizations through exploitation of internet-facing network perimeter devices, while Trend Micro described **Earth Estries** as conducting long-term intrusions across government, telecommunications, and information service providers in APAC, Taiwan, and NATO countries. Researchers said the cooperative model can place multiple China-linked actors in the same intrusion chain or even the same process flow, complicating attribution and incident response, and they highlighted exploitation of **Citrix** devices including `CVE-2025-5777` among the techniques used to gain or extend access.
Aug 21, 2026
Earth Baku, a cluster linked to **APT41**, has expanded a long-running cyberespionage campaign against government and enterprise targets from the Indo-Pacific into **Europe** and the **Middle East and Africa**, using a steadily evolving malware arsenal and multiple intrusion paths. Trend Micro reported the group has compromised organizations in sectors including airlines, automotive, infrastructure, media, publishing, IT, and hardware, with activity tied to **SQL injection** on public-facing applications, exploitation of **Microsoft Exchange ProxyLogon** `CVE-2021-26855`, IIS server abuse, and web shells including **China Chopper** and **Godzilla**. Earlier reporting also described possible email-delivered LNK downloader chains and continued operational activity after public law-enforcement scrutiny. The operators have introduced **StealthReacher**, an upgraded loader derived from **StealthVector**, to deploy **SneakCross**, a modular backdoor assessed as the successor to **ScrambleCross** and earlier **Crosswalk**-related tooling. Across reporting, the group was observed using **Cobalt Strike Beacon**, **ShadowPad**, **Natwalk**, **RBRAT**, **Errorroot**, **HIGHNOON**, and other loaders and backdoors, while relying on stealth techniques such as ETW disabling, process and DLL hollowing, module stomping, CFG bypass, early-bird injection, and certificate bypass. Researchers also said Earth Baku hid command-and-control through CDN services, **Cloudflare Workers**, and **Google services**, and supported persistence, tunneling, and exfiltration with customized **iox**, **Rakshasa**, **Tailscale**, and **MEGAcmd**.
Aug 15, 2026
Trend Micro disclosed that the China-aligned cluster **SHADOW-EARTH-053** compromised more than a dozen organizations in at least eight countries by exploiting vulnerable Microsoft Exchange and IIS servers, including the `ProxyLogon` chain, then deploying **GODZILLA** web shells and the **ShadowPad** backdoor to maintain access. Victims included government agencies, defense contractors, technology firms, transportation organizations, and at least one target in Poland, with activity observed from December 2024 through April 2026. Researchers said the intrusions resemble broader Chinese state-linked operations such as Salt Typhoon and Volt Typhoon and may support long-term espionage, prepositioning, and potential future disruption. Post-compromise activity included DLL sideloading with a renamed Toshiba Bluetooth Stack executable, registry-resident shellcode execution via `EnumDesktopsA` callback injection, scheduled-task persistence, mailbox collection from Exchange, credential theft, and lateral movement using tools such as **IOX**, **GOST**, **Wstunnel**, **Sharp-SMBExec**, **Mimikatz**, and **Evil-CreateDump**. Trend Micro also identified overlap with a related cluster, **SHADOW-EARTH-054**, including shared tool hashes, reused vulnerabilities, and compromises at some of the same organizations, although the company assessed the relationship as overlapping exploitation rather than clearly coordinated operations. Defenders were urged to patch Exchange and IIS systems quickly and review IIS worker process activity, web-shell indicators, and other signs of stealthy post-exploitation.
Jun 29, 2026