Earth KrahangThreat actor
Earth Krahang is an APT group targeting government organizations worldwide. They use spear-phishing emails, weak internet-facing servers, and custom backdoors like Cobalt Strike, RESHELL, and XDealer to conduct cyber espionage.From MISP Galaxy
Last reported 8 months ago, by JPCERT/CC Eyes1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1553.002Code Signing
“…onitoring persistence mechanisms with Autoruns and EDR solutions, and restricting AutoIt execution through AppLocker or WDAC based on code-signing information.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
JSAC2026 -Day 1-“Joseph Chen examined activities attributed to “Earth Lusca” and “Earth Krahang,” both reportedly linked to the Chinese company i-Soon.”
Thanks — we review every report.