Earth Preta

Earth Preta, also known as Mustang Panda, is a threat actor group that has been operational since at least 2012. The group has been highly active in Europe and Asia, with particular emphasis on the Asia-Pacific (APAC) region. Earth Preta employs several tools and commands for the Command and Control (C&C) stage of their operations, using a variety of malware including a variant of the DOPLUGS malware to target specific countries within the APAC region. Researchers have noted that Earth Preta's operations are highly targeted and time-sensitive, often involving rapid deployment and data exfiltration. In a recent campaign analyzed by cybersecurity researchers, Earth Preta was found to be executing highly targeted and time-sensitive operations, focusing on specific countries and industries within the APAC region. This was evidenced by the quick turnover of decoy documents and malware samples on a WebDAV server hosted by the group. The use of malware-loaded USB drives, a strategy that experienced a revival during and in the wake of the COVID-19 pandemic, has been identified as a primary infection vector used by this threat actor group. Looking forward, it is expected that Earth Preta will remain highly active in the foreseeable future, particularly within the APAC region. The group has recently shifted its focus to target critical infrastructure and key institutions, deploying malware through hybrid techniques. Given the group's continued activity and evolving tactics, it is crucial for organizations, especially those in the targeted regions and sectors, to maintain robust cybersecurity measures and stay abreast of the latest threat intelligence.