Earth Longzhi

Executive Summary

Earth Longzhi, also known as SnakeCharmer, appears to be a subgroup associated with APT41. It primarily targets organizations in Taiwan, Thailand, the Philippines, and Fiji using a novel denial-of-service (DoS) technique involving Image File Execution Options (IFEO), referred to as 'stack rumbling.' This group demonstrates intermediate sophistication with a focus on disrupting security software through innovative attack methods.

Goals & Targeting

The strategic goals of Earth Longzhi likely align with those of APT41, which has been linked to espionage and sabotage activities. The targeting of regions such as Taiwan, Thailand, the Philippines, and Fiji suggests a focus on regional stability or economic interests. The use of DoS techniques indicates an intent to disrupt or degrade the effectiveness of security software, possibly to facilitate access to targeted systems or to create conditions favorable for further attacks.

Earth Longzhi is a subgroup within the broader APT41 threat group, which has previously been associated with state-sponsored activities. The subgroup operates with a specific regional focus, targeting industries and organizations in Taiwan, Thailand, the Philippines, and Fiji. Its primary tactic involves 'stack rumbling,' a form of denial-of-service (DoS) attack that leverages Image File Execution Options (IFEO). This technique disrupts the execution of security software by manipulating stack operations, potentially leading to system instability or service interruptions. While specific campaign details are limited, the group's activities suggest a focus on disrupting or bypassing security measures to achieve its objectives.

Key Capabilities

• Intermediate-level cyber capabilities
• DoS attacks with novel techniques
• Manipulation of Image File Execution Options (IFEO)
• Targeted regional campaigns
• Potential ties to APT41

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Earth Longzhi's campaign patterns are not extensively documented, but its use of 'stack rumbling' suggests an emphasis on innovative attack methods. The group appears to operate with a regional focus, targeting specific industries in Southeast Asia and the Pacific. Past operations indicate a preference for disrupting security infrastructure rather than immediate data exfiltration, possibly as a precursor to more comprehensive attacks.

IOC Patterns

• Spear-phishing-like activity targeting specific regions
• IFEO registry manipulation
• Unusual process behavior related to stack operations

Recommended Actions

• Implement robust monitoring of IFEO settings and process behavior
• Enhance detection mechanisms for novel DoS techniques
• Conduct regular security assessments in targeted sectors
• Apply patches for known vulnerabilities related to image file execution
• Educate employees on regional geopolitical threats

Suggested Tags