Earth Krahang

Executive Summary

Earth Krahang is a suspected advanced persistent threat (APT) group targeting government organizations globally. The group employs sophisticated tactics including spear-phishing, custom backdoors (e.g., Cobalt Strike), and brute-force attacks to conduct cyber espionage. Their activities are linked to another Chinese-linked actor, Earth Lusca, suggesting potential collaboration within a specialized task force.

Goals & Targeting

Earth Krahang's strategic objectives appear to center on cyber espionage, likely aimed at gathering sensitive government information for political or national security purposes. The group's targeting profile focuses on government institutions, suggesting a focus on high-value, information-rich sectors. Their global reach indicates that they may be seeking broad access to diverse geopolitical intelligence. The victimology suggests a preference for organizations with weaker cybersecurity defenses and internet-facing systems that can be exploited for initial access.

Earth Krahang is an APT group known for targeting government organizations worldwide. The group utilizes spear-phishing emails and weak internet-facing servers as initial infection vectors. Once inside the target network, they deploy custom backdoors such as Cobalt Strike, RESHshell, and XDealer to maintain persistence and elevate privileges. Earth Krahang has been observed creating VPN servers on infected systems to establish command-and-control (C2) communication channels, which allows them to further propagate within the network. They are also known to brute-force email accounts to gain access to additional internal resources. The group exploits compromised government infrastructure to target other nations, indicating a long-term strategic focus on cyber espionage. Earth Krahang's operations suggest a high level of technical sophistication and organizational support, as evidenced by their ability to maintain extensive campaigns over time. Their modus operandi includes lateral movement within networks, data exfiltration, and persistence mechanisms, all of which align with typical APT behaviors.

Key Capabilities

• Spear-phishing campaigns
• Custom backdoors (e.g., Cobalt Strike, RESHshell, XDealer)
• VPNs for C2 communication
• Brute-force email attacks
• Lateral movement within networks
• Data exfiltration capabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Earth Krahang's campaign patterns include long-term, patient attacks that often go unnoticed. Their operational tempo suggests a methodical approach to network exploitation, with an emphasis on maintaining persistence and expanding access within the target environment. Past operations have targeted government institutions in multiple countries, indicating a global reach. Notable past operations include campaigns leveraging spear-phishing emails and custom malware, as well as brute-force attacks against email systems. Their collaboration with Earth Lusca suggests a potential larger network of cyber espionage actors linked to China.

IOC Patterns

• Spear-phishing emails targeting government employees
• Custom backdoor files dropped on infected systems
• VPN server creation on compromised systems
• Brute-force attempts on email accounts
• Changes in DNS TLDs or domain name structures
• Presence of Cobalt Strike beacons

Recommended Actions

• Implement multi-factor authentication (MFA) for email and VPN services.
• Regularly update and patch all internet-facing servers to mitigate exploitation vectors.
• Monitor network traffic for signs of C2 communication channels, particularly encrypted VPN-like traffic.
• Conduct user training to identify and report suspicious spear-phishing emails.
• Use endpoint detection and response (EDR) tools to identify custom backdoor malware.
• Segment sensitive networks and restrict access to critical systems.

Suggested Tags