Earth Alux

Executive Summary

Earth Alux is a China‑aligned APT known for sophisticated cyberespionage that blends spear‑phishing, zero‑day exploitation and custom backdoors. It targets high‑value sectors across Asia‑Pacific and Latin America, leveraging both legitimate tools (AnyDesk) and obscure vulnerabilities to move laterally and exfiltrate data. The group remains active amid evolving malware families such as Smokeloader and Sagerunex.

Goals & Targeting

Earth Alux’s primary objective is corporate and governmental intelligence gathering across geopolitically significant regions. By focusing on Asia‑Pacific, Latin America, and major industrial sectors—government, defense, telecommunications, energy, manufacturing, IT services, and finance—it seeks to acquire proprietary data that can influence national security or commercial advantage. The group’s use of legitimate RATs and zero‑day exploits underlines a strategy of low‑fingerprint infiltration designed to bypass perimeter defenses and maintain long‑term persistence for covert collection.

Key Capabilities

• Spear‑phishing with password‑protected ZIP attachments containing LNK launchers
• Obfuscated C# loaders that disable autoruns via registry modifications
• In‑memory execution of decrypted DLLs and PowerShell scripts
• Exploitation of zero‑day vulnerabilities: CVE‑2025‑0411 7‑Zip, CVE‑2025‑55182 React2Shell, Windows .lnk shortcut flaw (ZDI‑CAN‑25373)
• Double‑archiving to bypass Mark‑of‑the‑Web protection
• Delivery via remote administration tools such as AnyDesk
• Deployment of web shells like GODZILLA and backdoors VARGEIT, COBEACON, Sagerunex, Smokeloader, Merlin agent, VeilShell Trojans
• Use of HTTP GET requests for C&C communication instead of POST
• Exfiltration through DLL injection into svchost or custom Go exfil modules
• System data collection and host profiling
• Imitation/matching victim domain names (domain spoofing)
• LNK shortcut execution with hidden command‑line arguments
• Persistence via RAILSETTER injections in trusted processes
• Lateral movement with RSBINJECT and MASQLOADER

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Earth Alux’s campaigns are characterized by a high frequency of spear‑phishing events that target government and industry stakeholders in the Asia‑Pacific region, with spill‑over into Latin American entities. The attacker demonstrates an ability to pivot from initial compromise via surface‑level vulnerabilities or crafted attachments to deeper network infiltration, using lateral tools and custom RATs for persistence. Recent reports highlight a continued focus on exfiltrating classified data to cloud hosting and shadow infrastructure, suggesting a sustained operational tempo and the presence of well‑protected C2 channels.

IOC Patterns

• Password‑protected ZIP attachment in spear‑phishing emails
• LNK shortcut file execution
• Obfuscated DLL/C# loader disabling autorun via registry
• Double archiving to bypass Mark‑of‑the‑Web protection
• Zero‑day CVE‑2025‑0411 7‑Zip exploitation
• .lnk shortcut files with hidden command‑line arguments
• HTTP GET for C&C communication instead of POST
• DLL injected into svchost process for exfiltration
• Domain names mimicking victim domains
• Custom Go-based exfiltration modules
• CVE‑2025‑55182 React2Shell exploitation patterns
• Use of legitimate remote administration tools like AnyDesk

Recommended Actions

• Patch CVE‑2025‑0411 (7‑Zip) and other active Windows vulnerabilities immediately.
• Block or harden controls around password‑protected ZIP attachments in inbound email flows.
• Deploy EDR solutions tuned to detect obfuscated DLL/C# loaders, LNK file execution, and registry modifications that disable autoruns.
• Monitor for abnormal HTTP GET traffic originating from host processes and enforce stricter application whitelisting for unknown DLLs in svchost.
• Implement network segmentation and monitor lateral movement tooling such as RSBINJECT and MASQLOADER via IDS/IPS signatures.
• Use endpoint detection to alert on known backdoor binaries (Sagerunex, Smokeloader, Merlin) and custom Go exfil modules.
• Leverage domain filtering or reputation services to detect newly registered domains that spoof legitimate sites.
• Employ secure configuration hardening for remote administration tools, limiting AnyDesk usage via policy or network controls.

Suggested Tags