Earth NagaThreat actor
Earth Naga is an APT group that has persistently targeted high-value organizations, including government agencies, telecommunications, and military-related manufacturers, primarily in Taiwan and the broader APAC region.From MISP Galaxy
Last reported 12 months ago, by Trend Micro Research1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1003.001LSASS Memory
“Blindsight, a publicly available tool to dump LSASS memory with evasion techniques based on transactional NTFS”
- T1195Supply Chain Compromise
“Attacks leveraging supply chain compromise.”
- T1505.003Web Shell
“Deployment of backdoors via web shells, exploitation of vulnerable public-facing servers, or similar methods.”
- T1547.005Security Support Provider
“A custom tool dumping memory from its loading process, probably used as security support provider (SSP) to dump LSASS memory, detected as HackTool.Win64.MINIDUMP.ZALL”
What the reports say
1 report, newest first · the exact sentence from each-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“…ween China-aligned APT groups via the new “Premier Pass-as-a-Service” model, exemplified by the recent activities of Earth Estries and Earth Naga.”
Indicators in its reports
named in the reports above- back-trust-aurora.cluster-ctrjumtpbmf.mnl-east-2.timcorpnet[.]comin 1 report
- afddd9d14453d4f9-1e185df7e4.ap-southeast-mnl.timcorpnet[.]comin 1 report
- 103.175.16[.]77in 1 report
- 45.92.158[.]50in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.