Trend Micro researchers uncovered a sophisticated campaign conducted by a threat actor tracked as Earth Krahang that breached 70 organizations worldwide.
The campaign seems active since at least early 2022 and focuses primarily on government organizations.
The group often exploited access to government infrastructure to target other government entities. The threat actors used this infrastructure to host malicious payloads, proxy attack traffic, and send spear-phishing emails to government-related targets, leveraging compromised government email accounts.
The APT group also established access into victims’ private networks by creating VPN servers on compromised public-facing servers and conducting brute-force attacks to obtain email credentials. Then the attackers used these credentials to steal victim emails.
The group appears to be politically motivated and acting for cyberespionage purposes.
Earth Krahang was observed exploiting the following vulnerabilities to deploy webshells on target servers and gain a foothold within victim networks:
CVE-2023-32315: command execution on OpenFire
CVE-2022-21587: command execution on Oracle Web Applications Desktop Integrator
The spear-phishing messages used by the attackers are designed to deceive victims into opening attachments or clicking on embedded URL links, which ultimately result in the deployment of a backdoor on the victim’s machine.
Earth Krahang was observed retrieving hundreds of email addresses from their targets during the reconnaissance phase. In one instance, the threat actors used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses belonging to the same entity.
Trend Micro reported that Earth Krahang carried out brute force attacks on Exchange servers through their Outlook Web Access (OWA) portals belonging to its victims. The attackers use a list of common passwords to test the email accounts on the target’s email server. The researchers also observed the APT group using a custom Python script to carry out brute-forcing activity against the ActiveSync service on the OWA server.
Trend Micro also discovered a Python script used to exfiltrate emails from Zimbra servers.
Trend Micro identified 70 victims from 23 different countries. The experts believe that the APT group compromised or targeted organizations in 45 different countries, most of them in Asia and America, but also in Europe and Africa.
Trend Micro says it initially found ties between Earth Krahang and the China-nexus actor Earth Lusca, based on command and control (C2) overlaps, but determined that this is a separate cluster.
It is possible that both threat groups operate under the Chinese company I-Soon, working as a dedicated task force for cyberespionage on government entities.
Comments