Earth Tengshe

Earth Tengshe, also known as Bronze Riverside, is a threat actor believed to be associated with APT10, a notorious cyber espionage group. This entity has been involved in several malicious campaigns, including the "A41APT Campaign" and the "LODEINFO Campaign #1", suggesting a continuous pattern of activity aimed at compromising various industries. Earth Tengshe's methods involve the use of custom malware such as SigLoader, SodaMaster, P8RAT, FYAnti, and Jackpot, differing from those used by another subgroup, Earth Kasha, in the LODEINFO Campaign #2. In late 2021, Earth Tengshe targeted overseas subsidiaries and suppliers of Japanese manufacturing, engineering, electronics, automotive, energy, and technology companies, ostensibly to gain access to parent companies in Japan. This indicates a strategic focus on high-value targets that could provide valuable industrial and technological information. Both Earth Tengshe and Earth Kasha have shown a tendency to target public-facing applications, aiming to exfiltrate data and information within networks. This tactic is common among threat actors pursuing espionage or extortion objectives. APT10, the umbrella group to which Earth Tengshe and Earth Kasha belong, is characterized by its use of custom malware for espionage-related exploits across a wide range of regions. The possible shared operator resources or tactics, techniques, and procedures (TTPs) between Earth Tengshe and Earth Kasha suggest a coordinated approach towards their malicious activities. It is crucial to understand these patterns and similarities to develop effective countermeasures against such persistent threats.