Earth Estries
| Actor Type | Nation State |
|---|---|
| Attributed to Nation | China |
| Directly Linked Intrusion Sets | GhostEmperor , FamousSparrow , Salt Typhoon , Operator Panda |
Earth Estries is a Chinese advanced persistent threat (APT) group tracked by Trend Micro. The group has been observed actively targeting critical sectors such as telecommunications, government entities, and various industries across the US, Asia-Pacific, Middle East, and South Africa since 2023.
Earth Estries employs sophisticated techniques and multiple backdoors, including GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, to conduct prolonged espionage operations. They exploit public-facing server vulnerabilities for initial access and use living-off-the-land binaries for lateral movement within networks. The group's tradecraft shows overlaps in TTPs (tactics, techniques and procedures) with other known Chinese APT groups, indicating possible use of shared tools from malware-as-a-service providers.
The group's activities have compromised over 20 organizations, targeting sectors such as technology, consulting, chemical, and transportation, as well as government agencies and NGOs. Earth Estries maintains persistence through customized malware and complex command-and-control (C2) infrastructure managed by different teams. Their operations involve continuous tool updates and lateral movement to deploy malware and conduct long-term espionage. The group's sophisticated and persistent approach poses a significant threat to targeted sectors, highlighting the need for robust cybersecurity measures.
Cyber Threat Graph Context
Explore how this Intrusion Set relates to the wider threat graph