Earth Longzhi

Also known as: Earth Longzhi, SnakeCharmer

Earth Longzhi is a subgroup of APT41 targeting organizations based in Taiwan, Thailand, the Philippines, and Fiji, and using “stack rumbling” via Image File Execution Options (IFEO), a new denial-of-service (DoS) technique to disable security software.

🌍 Country ["China"]

Associated Operations

2023-04 Attack on Security Titans: Earth Longzhi Returns With New Tricks https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html

Introduction

Earth Longzhi is a subgroup of APT41 targeting organizations based in Taiwan, Thailand, the Philippines, and Fiji, and using “stack rumbling” via Image File Execution Options (IFEO), a new denial-of-service (DoS) technique to disable security software.

Activities and Tactics

Country of Origin: 🇨🇳 [“China”]

Notable Campaigns

  • 2023-04
  • Attack on Security Titans: Earth Longzhi Returns With New Tricks
  • https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • BigpipeLoader:
  • Cobalt Strike:
  • CroxLoader:
  • MultiPipeLoader:
  • OutLoader:
  • Symatic Loader:

Attribution and Evidence

Country of Origin: [“China”] Additional attribution information pending cataloguing.

References

References pending cataloguing.