Longzhi

Earth Longzhi, a subgroup within the notorious APT41 cyber espionage group, has re-emerged after months of dormancy, according to cybersecurity researchers at Trend Micro. The threat actor has been known for its malicious activities since 2020 and has recently targeted organizations in Taiwan, Thailand, the Philippines, and for the first time, Fiji. The sectors affected include government, healthcare, technology, and manufacturing. Earth Longzhi's resurgence is marked by new techniques in its infection routine, primarily targeting vulnerable internet-exposed servers. This recent activity indicates that Earth Longzhi remains a significant threat with an evolving modus operandi. The researchers discovered that Earth Longzhi has developed a novel method to disable security products, a technique they termed 'stack rumbling' via Image File Execution Options (IFEO), which is a new denial-of-service (DoS) technique. The group primarily deploys two types of malware: Croxloader, a loader for Cobalt Strike, and a new anti-detection tool called SPHijacker. Instead of relying on traditional phishing emails, Earth Longzhi tends to target public-facing Internet Information Services (IIS) and Microsoft Exchange servers to install the popular Behinder Web shell. Using Behinder, it can gather information and download further malware onto host systems. Despite Earth Longzhi's hiatus since its last campaign that ended in June 2022, the group's return signals its resilience as a noteworthy threat. The samples collected by Trend Micro not only reveal potential targets but also provide insights into the new techniques that Earth Longzhi might employ in future campaigns. Given these developments, organizations, especially those with public-facing internet services, are urged to ensure their systems are fully patched and updated to mitigate the risk of intrusion.