Earth KurmaThreat actor
Earth Kurma is an APT group targeting government and telecommunications sectors in Southeast Asia, with a primary focus on data exfiltration. They employ advanced custom malware, including rootkits like KRNRAT and MORIYA, and utilize cloud storage services for exfiltration. Their toolsets include TESDAT and SIMPOBOXSPY, and they demonstrate adaptive TTPs and complex evasion techniques.From MISP Galaxy
Last reported 8 months ago, by JPCERT/CC Eyes1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1553.002Code Signing
“…onitoring persistence mechanisms with Autoruns and EDR solutions, and restricting AutoIt execution through AppLocker or WDAC based on code-signing information.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
JSAC2026 -Day 1-“Lu shared findings on the APT group “Earth Kurma,” which targets government and telecommunications sectors in Southeast Asia.”
Thanks — we review every report.