Earth Longzhi

Earth Longzhi, a suspected subgroup of the notorious APT41, has reemerged after months of inactivity and is now attacking organizations across various industries in Southeast Asia. This group had been on hiatus since its last campaign which ran from August 2021 to June 2022. Trend Micro's investigation revealed two distinct campaigns carried out by Earth Longzhi between 2020 and 2022. The group's current campaign targets organizations in government, healthcare, technology, and manufacturing sectors in the Philippines, Thailand, Taiwan, and Fiji - a country they've never targeted before. The group's modus operandi involves the use of DLL sideloading and Fastly CDN - tools popular with APT41 subgroups, to reduce the risk of exposure and detection. There are overlaps found between Earth Estries' backdoor loader and FamousSparrow's, indicating similar tactics or shared resources. Earth Longzhi also primarily delivers two types of malware according to Trend Micro: Croxloader, a loader for Cobalt Strike, and a new anti-detection tool called SPHijacker. Operation Crimson Palace involved tools and infrastructure that overlap with several known Chinese threat actors, including Worok and the APT41 subgroup Earth Longzhi. The group's evolving Tactics, Techniques, and Procedures (TTPs) show a preference for targeting public-facing Internet Information Services (IIS) and Microsoft Exchange servers as entry points to install the popular Behinder Web shell. This allows them to gather information and download further malware onto host systems. As Earth Longzhi continues to refine its stealth tactics in espionage campaigns, potential targets are advised to ensure their environment, especially those exposed to the internet, are fully patched and updated to mitigate the risk of attacks.