Earth Kurma

Executive Summary

Earth Kurma is a financially motivated APT that has targeted Southeast Asian governments and telecommunications providers since at least November 2020. The group deploys custom kernel‑level rootkits such as KRNRAT and MORIYA, along with loaders that seed Cobalt Strike beacons, to maintain persistence while exfiltrating data through trusted public cloud services like Dropbox and OneDrive.

Goals & Targeting

Earth Kurma’s primary objective appears to be financial gain through the acquisition of valuable data which can be leveraged or sold. They selectively target sectors that offer high-value intelligence—government, telecommunications, energy and critical infrastructure—in Southeast Asian nations such as Vietnam, Singapore, Malaysia, Thailand and the Philippines, with occasional activity noted against US or Chinese assets. Their tactics reflect a blend of tailored persistence mechanisms and stealthy exfiltration, aimed at extracting monetary value while evading security operations.

Key Capabilities

• Deploy advanced custom malware and kernel‑level rootkits for persistence
• Exfiltrate stolen data via public cloud services such as Dropbox and OneDrive
• Target government and telecommunications organizations in Southeast Asia (and related sectors)
• Perform lateral movement using SMB net use protocol
• Conduct network reconnaissance with ICMP ping scans
• Employ keylogging to harvest credentials
• Execute process injection and memory‑resident payloads
• Conceal files and processes for stealthy presence
• Utilize living‑off‑the‑land binaries like syssetup.dll for covert operations
• Adapt TTPs to victim environment, reusing code from prior campaigns
• Leverage victim infrastructure and cloud platforms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Earth Kurma first surfaced in late 2020, launching a series of campaign waves that exploited custom rootkits and lightweight loaders to embed Cobalt Strike beacons into government and telecom networks across Southeast Asia. The group’s operations exhibit a disciplined cadence, typically spanning a few weeks per attack phase, and frequently involve scanning for SMB shares before deploying keylogging utilities. While its financial motive dominates, the selection of high‑profile governmental and critical infrastructure targets suggests an agenda of influencing political or intelligence outcomes. Recent activity indicates evolving tool reuse practices, with newer iterations rebranding previously seen malware components to evade detection.

IOC Patterns

• Use of public cloud storage services (Dropbox, OneDrive) for exfiltration
• Deployment of kernel‑level rootkits such as KRNRAT and MORIYA
• Custom malware toolset signatures and loaders (TESDAT, DUNLOADER)
• File path targeting like %AppData%\Roaming\Microsoft\Windows\Libraries\infokey.zip
• Use of syssetup.dll for INF file deployment and stealth
• Process injection via NtCreateThreadEx syscall in ntdll.dll
• Zip archives containing keylogging data or stolen credentials

Recommended Actions

• Deploy endpoint detection and response solutions capable of detecting custom loaders TESDAT, DUNLOADER and SIMPOBOXSPY
• Monitor outbound traffic to public cloud platforms (Dropbox, OneDrive) and flag abnormal upload patterns
• Implement regular patching and monitor for unauthorized usage of kernel‑level rootkits KRNRAT/MORIYA or syssetup.dll loading
• Block execution of known keylogging utilities such as KMLOG
• Enforce least privilege on SMB shares and detect SMB net use activity to stop lateral movement
• Configure intrusion detection systems to identify ICMP ping sweeps and network reconnaissance
• Restrict execution of unofficial binaries like syssetup.dll; establish whitelisting policies for DLLs
• Use host‑based IDS to flag process injection (T1055) and hidden processes (T1070.004)
• Segment critical infrastructure networks from external cloud endpoints to mitigate exfiltration paths

Suggested Tags