Earth EstriesThreat actor
Trend Micro found that Earth Estries relies heavily on DLL sideloading to load various tools within its arsenal. Aside from the backdoors previously mentioned, this intrusion set also utilizes commonly used remote control tools like Cobalt Strike, PlugX, or Meterpreter stagers interchangeably in various attack stages. These tools come as encrypted payloads loaded by custom loader DLLs.From MISP Galaxy
Last reported 1 month ago, by Infosecurity Magazine5 reports
ATT&CK techniques
6 of 50 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“T1027.007”
- T1033System Owner/User Discovery
“T1033”
- T1036Masquerading
“Masquerading: Invalid Code Signature”
- T1036.001Invalid Code Signature
“T1036.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor“Trend Micro has linked it to Earth Estries, though ESET said that link is not fully understood, and it tracks FamousSparrow separately from Salt Typhoon for want of technical indicators.”
-
FamousSparrow centra sus operaciones en América Latina y despliega el nuevo backdoor SparroWocky“Como señaló Trend Micro, FamousSparrow está vinculado a Earth Estries; sin embargo, la naturaleza exacta de esa relación aún no se conoce por completo.”
-
Beware the SparroWock: The backdoor that bites, the commands that catch“As mentioned by Trend Micro, FamousSparrow is linked to Earth Estries; however, the exact nature of the link is not fully known.”
-
JSAC2026 -Day 1-“Although potential links to known groups such as Earth Estries were considered, attribution was assessed with low confidence.”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“…relationship between China-aligned APT groups via the new “Premier Pass-as-a-Service” model, exemplified by the recent activities of Earth Estries and Earth Naga.”
Indicators in its reports
named in the reports above- 44f0a22b143b79fa…fff714c8a2a1in 2 reports
- 216.238.110[.]120in 2 reports
- 3209689e509205cc…407ddc23cac1in 2 reports
- 52c6646759cf6037…1c4bd794532fin 2 reports
- 99e7070b5af24a0f…b03cb385e91fin 2 reports
- 9aa9ff61bc63ccab…c980ca9ddc8cin 2 reports
- 38.54.57[.]17in 2 reports
- 38.60.197[.]55in 2 reports
- 38.60.209[.]106in 2 reports
- 38.60.224[.]51in 2 reports
- 38.60.224[.]235in 2 reports
- 38.60.241[.]65in 2 reports
- 38.60.241[.]127in 2 reports
- 38.60.241[.]193in 2 reports
- 77.111.101[.]40in 2 reports
- 91.148.134[.]115in 2 reports
- 130.94.101[.]82in 2 reports
- 140.99.164[.]199in 2 reports
- 149.104.87[.]228in 2 reports
- 149.104.90[.]203in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.