Earth AluxThreat actor
Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, technology, and telecommunications. They primarily exploit vulnerable services in exposed servers to gain initial access, implanting web shells like GODZILLA and deploying backdoors such as VARGEIT and COBEACON.From MISP Galaxy
Last reported 22 days ago, by The Hacker News4 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1505.003Web Shell
“Researchers found the actor typically gained access through vulnerable IIS and SharePoint servers before deploying web shells and a sophisticated backdoor tracked as VARGEIT, Squidoor or FinalDraft.”
- T1003.006DCSync
“… observed the group dropping and executing a binary called newdcsync, which, based on the command line and filename, was likely used for DCSync attacks.”
- T1021.001Remote Desktop Protocol
“We also observed the group deploying a suspected custom remote desktop protocol (RDP) launcher (under the name smss.exe) and a C# implementation of SMBExec known as Sharp-SMBExec.”
- T1047Windows Management Instrumentation
“SHADOW-EARTH-053 uses Windows Management Instrumentation Command-line (WMIC) for lateral movement, installing backdoors and tools onto additional hosts.”
- T1053.005Scheduled Task
“Persistence was achieved via a Scheduled Task named M1onltor, configured to run the sideloaded binary every five minutes with the highest privileges.”
- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign“… some level of overlap with Jewelbug, which, in turn, exhibits tactical similarities with China-aligned clusters known as CL-STA-0049, Earth Alux, Ink Dragon, and REF7707.”
-
August 2026 Threat Trend Report on APT Groups“Mustang Panda used hydropower-themed lures along with the Claimloader, ToneShell v10, and Havencode backdoors, while Earth Alux (Jewelbug) utilized XG-Web, Antino, PDF Viewer, and ClientKing for both espionage activity and cryptocurrency scams.”
-
Researchers Link 'Jewelbug' Chinese APT to Hack-for-Hire Operations“…ether experts from Symantec and Carbon Black – shed new light on the advanced persistent threat (APT) group, also known as Ink Dragon, Earth Alux, REF770 and CL-STA-0049.”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“…et has some network overlaps with CL-STA-0049 by Unit 42 and REF7707 by Elastic, two other intrusion sets that also have overlaps with Earth Alux (we examine these links in the “Attribution” section).”
Indicators in its reports
named in the reports above- 4264cfb3980a068a…40e59885f5c8in 1 report
- 2e8f9fd8213d9f69…93d881c04cd2in 1 report
- 8d9433e9734dd629…d344de733c78in 1 report
- d67197bf407e74ec…7df65cf429b3in 1 report
- 141.164.46[.]77in 1 report
- 96.9.125[.]227in 1 report
- 194.38.11[.]3in 1 report
- check.office365-update[.]comin 1 report
- 209.141.40[.]254in 1 report
- zimbra-beta[.]infoin 1 report
- rsproxy[.]cnin 1 report
- d32tpl7xt7175h.cloudfront[.]netin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.