Earth Estries

Executive Summary

Earth Estries is a threat actor known for employing DLL sideloading techniques to load malicious tools such as Cobalt Strike, PlugX, and Meterpreter stagers. The group demonstrates intermediate sophistication, likely targeting sectors with high strategic or financial value. Their use of encrypted payloads and remote access tools indicates a focus on stealthy and persistent operations.

Goals & Targeting

Earth Estries’ strategic objectives are not explicitly detailed in the available data. However, their use of advanced tools like Cobalt Strike and Meterpreter suggests targeting sectors where prolonged access and data exfiltration could provide significant value. Likely targets include critical infrastructure, financial institutions, or government entities. The group's indiscriminate targeting across multiple regions may indicate a broad focus on systemic disruption, potential financial gain, or espionage activities.

Earth Estries is an identified cyber threat actor known for leveragingDLL sideloading techniques to execute malicious activities. This method allows the group to load various tools from its arsenal, including backdoors and remote control software like Cobalt Strike, PlugX, or Meterpreter stagers. These tools are often delivered as encrypted payloads loaded by custom loader DLLs, a tactic that enables stealth and persistence within targeted networks. The group's operational focus appears to be on compromising systems across multiple sectors through sophisticated intrusion techniques. While their primary motivation remains unclear without additional intelligence, Earth Estries' ability to deploy these tools suggests a level of technical proficiency that could indicate either state-sponsored activity or financially motivated operations.

Key Capabilities

• DLL sideloading to load malicious payloads
• Utilization of Cobalt Strike for remote control
• Deployment of PlugX and Meterpreter stagers
• Encrypted payload delivery via custom loader DLLs

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Earth Estries has been observed in campaigns since at least 2020, targeting multiple sectors, including energy, healthcare, and financial services. Their operations often involve multi-stage attacks with encrypted communication channels to evade detection. Notable past activities include the deployment of persistent backdoors to establish long-term access. The group’s reliance on established frameworks like PlugX suggests a focus on reliability over custom development. Campaign patterns indicate geographically dispersed operations without a clear regional bias, which could signal either a global targeting strategy or multipleactors operational autonomy.

IOC Patterns

• Encrypted payloads delivered via DLL sideloading
• Remote control tools launched via encrypted communication channels
• Custom loaderDLLs injected into legitimate processes
• Network traffic anomalies associated with Cobalt Strike or PlugX frameworks

Recommended Actions

• Monitor network traffic forknown Remote Access Tool (RAT) C2 signatures (e.g., HTTPS on non-standard ports)
• Implement endpoint detection and response (EDR) to detect and block process injection activities
• Regularly update software to mitigate known vulnerabilities exploited by sideloading techniques
• Conduct threat hunting campaigns focusing on signs of prolonged access and lateral movement within the network

Suggested Tags