Earth BaxiaThreat actor
Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote code execution, deploying customized Cobalt Strike components with altered signatures, leveraging GrimResource and AppDomainManager injection techniques to deliver…From MISP Galaxy
Last reported 8 months ago, by Trend Micro Research1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1553.002Code Signing
“One of campaigns leverage stolen code-signing certificates Cobalt Strike payloads, and exploits (CVE-2020-16040) hosted across multiple C&C domains and IP addresses to maintain persistent access.”
- T1684Social Engineering
“Scripts for social engineering pop-ups designed to deceive victims into downloading and executing malicious files.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“The threat actor also simultaneously downloaded files from 47.238.184.9, an IP address has been previously linked to Earth Baxia.”
Indicators in its reports
named in the reports above- 47.238.219[.]111in 1 report
- center.myrnicrosoft[.]comin 1 report
- mkdmcdn[.]comin 1 report
- 162cc325ab7b6e70…52130c56903fin 1 report
- oss-cdn[.]comin 1 report
- bbd2b9b87f968ed8…e30711e8365bin 1 report
- github.githubassets[.]netin 1 report
- 47.238.184[.]9in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.