Earth KapreThreat actor
- gold blade
- red wolf
Earth Kapre is an APT group specializing in cyberespionage. They target organizations in various countries through phishing campaigns using malicious attachments to infect machines. Earth Kapre employs techniques like abusing PowerShell, curl, and Program Compatibility Assistant to execute malicious commands and evade detection within targeted networks.From MISP Galaxy
Last reported 19 months ago, by Huntress1 report
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027.010Command ObfuscationUsed obfuscated powershell commands”
- T1036Masquerading
“T1036.004Masquerading: Masquerade Task or Service”
- T1036.004Masquerade Task or Service
“T1036.004Masquerading: Masquerade Task or Service”
- T1053.005Scheduled Task
“We discovered several scheduled tasks that were used to execute the”
- T1059Command and Scripting Interpreter
“T1059.001PowershellExecuted powershell scripts and commands”
- T1059.003Windows Command Shell
“…vents we observed and discussed in this blog revolved mainly around scheduled tasks, 7zip, pcalua, and scripts using PowerShell, Windows command shell, and Python.”
What the reports say
1 report, newest first · the exact sentence from each-
Hunt for RedCurl“Earth Kapre and”
Indicators in its reports
named in the reports above- bora.teracloud[.]jpin 1 report
- 193.176.158[.]30in 1 report
- 188.130.207[.]253in 1 report
- mainsts-01.cn.alphastoned[.]proin 1 report
- 172.67.214[.]172in 1 report
- 104.21.37[.]229in 1 report
- 23.254.224[.]79in 1 report
- alphastoned[.]proin 1 report
- ihateregex[.]ioin 1 report
- 8117e40ee7f824f6…35aad3b83549in 1 report
- ea308c76a2f927b1…4e05164e716din 1 report
- 104.21.22[.]32in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.