Chinese-Endorsed Earth Baku Widens Cyber Offensives to Europe, Middle East, and Africa
The Chinese-backed threat group known as Earth Baku has expanded its target scope beyond the Indo-Pacific region to cover Europe, the Middle East, and Africa commencing in late 2022.
Newly targeted regions encompass Italy, Germany, the U.A.E., and Qatar, with suspected breaches also identified in Georgia and Romania. Various sectors such as governments, media and communications, telecoms, technology, healthcare, and education have been specifically singled out as part of the intrusion campaign.
“The group has enhanced its methods and strategies in recent operations, utilizing public-facing applications like IIS servers as entry points for assaults, following which they deploy sophisticated malicious toolsets within the victim’s infrastructure,” highlighted Trend Micro researchers Ted Lee and Theo Chen in an analysis report released last week.
The findings elaborate on recent disclosures from Zscaler and Google-owned Mandiant, which also detailed the group’s employment of malware variants like DodgeBox (also recognized as DUSTPAN) and MoonWalk (also known as DUSTTRAP). Trend Micro has assigned them the aliases StealthReacher and SneakCross.
Earth Baku, an entity linked with APT41, is renowned for utilizing StealthVector dating back to October 2020. The attack chain involves exploiting public-facing applications to deploy the Godzilla web shell, which is then utilized to transmit subsequent payloads.
StealthReacher has been labeled as an upgraded version of the StealthVector backdoor loader responsible for initiating SneakCross, a modular implant regarded as a potential successor to ScrambleCross that exploits Google services for its command-and-control (C2) communication.
The incursions are also characterized by the utilization of additional post-breach tools like iox, Rakshasa, and a Virtual Private Network (VPN) service called Tailscale. Transfer of sensitive data to the MEGA cloud storage platform is executed through a command-line utility named MEGAcmd.
“The group has introduced new launchers such as StealthVector and StealthReacher to surreptitiously deploy backdoor components and unveiled SneakCross as their latest modular backdoor,” as detailed by the researchers.
“Earth Baku also utilized various utilities during its post-breach phase including a customized iox tool, Rakshasa, TailScale for maintaining persistence, and MEGAcmd for efficient data extraction.”
About Author
