Earth Preta

Earth Preta, also known as Mustang Panda or Stately Taurus, is a high-profile threat actor group that has been actively executing cyberattacks with malicious intent. Their activities have been particularly prevalent in the Asia Pacific (APAC) region and Europe. The group employs a variety of tools and malware for command and control (C&C) stages, including backdoor functionalities inferred from internal strings and APIs used by the group. Previous research disclosed a new campaign initiated by Earth Preta that targeted governments worldwide through spear-phishing techniques. The group's attacks are highly targeted and time-sensitive, often involving rapid deployment and data exfiltration. They focus on specific countries and sectors within the APAC region, suggesting an execution of highly targeted operations. A notable strategy employed by Earth Preta involves the use of malware-loaded USB drives, a method that saw a resurgence during and post the COVID-19 pandemic. Additionally, the group has been linked to the Fireant group and has been observed using a variant of the DOPLUGS malware to target Asian countries. Despite attempts to attribute some of the activities of CeranaKeeper to Mustang Panda, it was decided to track this activity cluster as the work of CeranaKeeper. However, similarities among the Tactics, Techniques, and Procedures (TTPs), the malware used, and the timeline of the campaigns allowed for attribution of some activities to Earth Preta. Given their continued activity, especially in the APAC region, it is likely that Earth Preta will remain a significant threat in the foreseeable future.