Earth Minotaur

Also known as: Earth Minotaur

(Trend Micro) We believe that Earth Minotaur is an intrusion set which hasn’t been publicly reported. In the first report of MOONSHINE exploit kit in 2019, the threat actor using the toolkit was named ‘Poison Carp, Evil Eye’. While both used the MOONSHINE exploit kit and had similar targets, we did not find further connections between Earth Minotaur and POISON CARP. The backdoor DarkNimbus had been developed in 2018 but was not found in any of POISON CARP’s previous activity. Therefore, we categorized them as two different intrusion sets.

🌍 Country ["China"]

Introduction

(Trend Micro) We believe that Earth Minotaur is an intrusion set which hasn’t been publicly reported. In the first report of MOONSHINE exploit kit in 2019, the threat actor using the toolkit was named ‘Poison Carp, Evil Eye’. While both used the MOONSHINE exploit kit and had similar targets, we did not find further connections between Earth Minotaur and POISON CARP. The backdoor DarkNimbus had been developed in 2018 but was not found in any of POISON CARP’s previous activity. Therefore, we categorized them as two different intrusion sets.

Activities and Tactics

Country of Origin: 🇨🇳 [“China”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • DarkNimbus
  • MOONSHINE
  • DarkNimbus:
  • MOONSHINE:

Attribution and Evidence

Country of Origin: [“China”] Additional attribution information pending cataloguing.

References

References pending cataloguing.