Earth Wendigo

Executive Summary

Earth Wendigo, a suspected state-sponsored threat actor originating from China, has been actively targeting government and educational institutions in Taiwan since May 2019. The group employs sophisticated techniques including spear-phishing campaigns and JavaScript-based backdoor injections to gain unauthorized access to webmail systems, aiming to exfiltrate sensitive emails for potential espionage purposes.

Goals & Targeting

Earth Wendigo's primary objectives appear to be intelligence collection and espionage, particularly targeting individuals and organizations involved in politically sensitive issues. Their focus on Taiwan, along with their interest in movements related to Tibet, Uyghur regions, and Hong Kong, indicates possible state-sponsored activities aimed at gathering information that could influence China's geopolitical strategies or undermine opposition groups.

Earth Wendigo is a cyber threat actor identified as originating from China, specifically targeting government organizations, research institutions, and universities in Taiwan. Since their first appearance in May 2019, their primary method of attack involves the injection of JavaScript backdoors into webmail systems widely used within Taiwan. This technique allows them to compromise email accounts and exfiltrate sensitive communications. Additionally, Earth Wendigo has engaged in spear-phishing campaigns, sending malicious links embedded within emails to individuals associated with political movements in Tibet, the Uyghur region, or Hong Kong. These targeting patterns suggest a strategic focus on获取政治相关的敏感信息 or disrupting activities aligned with specific Chinese government interests.

Key Capabilities

• Injection of JavaScript backdoors into webmail systems
• Spear-phishing campaigns with embedded malicious links
• Compromise of email accounts for data exfiltration
• Potential use of custom malware frameworks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Earth Wendigo has demonstrated consistent activity since 2019, primarily targeting Taiwan's government and education sectors. Campaign patterns include prolonged email compromise operations and targeted phishing attempts against specific individuals. Their operational tempo suggests a structured approach to long-term intelligence gathering, possibly with an aim to remain undetected for extended periods.

IOC Patterns

• Spear-phishing emails containing malicious links
• Injected JavaScript in webmail systems
• Malicious scripts targeting email exfiltration

Recommended Actions

• Implement robust anti-spam and phishing filters to detect malicious emails
• Monitor for script injection attempts on webmail platforms
• Conduct regular security audits of educational and government IT infrastructure
• Educate users on spotting phishing attempts and suspicious emails

Suggested Tags