Earth Estries

Earth Estries, also known as Salt Typhoon, FamousSparrow, GhostEmperor, and UNC2286, is a sophisticated threat actor that has been conducting long-term espionage attacks against government entities and other targets since 2020. Originating from the People's Republic, Earth Estries ranks among the most advanced persistent threats (APT). The group displays a keen understanding of their target environments, continually identifying exposed layers for re-entry. With access to targeted networks, Earth Estries can deploy a diverse arsenal of powerful payloads, including new backdoors like Crowdoor, tools like Cobalt Strike, Zingdoor, and Snappybee, which are consistently being built out. The modus operandi of Earth Estries involves exploiting vulnerabilities in web-based adapter management tools like QConvergeConsole and vulnerable Exchange servers. In one infection chain, Earth Estries exploited these vulnerabilities using tools like Cobalt Strike, Hemigate, and Crowdoor delivered via CAB file packages. In another, they capitalized on vulnerable Exchange servers, making use of web shells such as ChinaChopper and additional backdoors like Zingdoor, SnappyBee, and Cobalt Strike. These tactics highlight the diversity of Earth Estries' toolkit and their strategic approach to maintaining access and control within compromised environments. Earth Estries employs various loading methods for its tools, particularly Cobalt Strike, and collects user credentials to further its objectives. Our analysis reveals a sophisticated and adaptable threat actor that not only demonstrates high technical capabilities but also a strategic approach to prolonged cyber operations. The group uses a range of RAR commands over the course of its campaigns, indicating a comprehensive understanding of their target environments. It is crucial to continue monitoring this threat actor given their consistent evolution and the potential risk they pose to governments and organizations worldwide.