.svg)
.svg)
Earth Krahang APT Group: Global Government Cyberespionage Campaigns (2022–2024) and TTP Analysis
Earth Krahang group has been active since early 2022, primarily targeting government entities across multiple continents, including Southeast Asia, Europe, the Americas, and Africa.
Earth Krahang's operations are characterized by their strategic exploitation of intergovernmental trust. The group has been observed leveraging compromised government infrastructure to launch attacks on other governmental organizations. This includes hosting malicious payloads, proxying attack traffic, and disseminating spear-phishing emails using compromised government email accounts.
Earth Krahang's operations are characterized by their strategic exploitation of intergovernmental trust. The group has been observed leveraging compromised government infrastructure to launch attacks on other governmental organizations. This includes hosting malicious payloads and disseminating spear-phishing emails using compromised government email accounts.
Earth Krahang's operations demonstrate a broad and strategic targeting profile. Analysis revealed approximately 70 confirmed victims across 23 countries. Government organizations constitute the primary focus of Earth Krahang. For instance, in one country, the group successfully compromised organizations across 11 different government ministries. Overall, at least 48 government entities were confirmed compromised [1].
In the following sections, we will review the historical and significant campaigns attributed to Earth Krahang group, analyze their tactics, techniques, and procedures (TTPs), and conclude with a section on how Picus simulates Earth Krahang's attacks to help organizations evaluate and strengthen their defensive posture.
Simulate APT Attacks with 14-Day Free Trial of Picus Platform
History & Major Activities of Earth Krahang Group
-
2022 - 2024 - Earth Krahang group conducted a two-year cyberespionage operation, infiltrating 70 organizations—predominantly government agencies—across 23 countries.
ATT&CK Mapping (TTPs) of Earth Krahang Group
Tactic: Reconnaissance
T1589.002 Gather Victim Identity Information: Email Addresses
Earth Krahang gathered hundreds of email addresses during reconnaissance. In one incident, they used a compromised government mailbox to send a malicious RAR attachment to 796 addresses within that same agency. The RAR contained an LNK that installed the Xdealer malware and displayed a decoy document about the agency [1].
Tactic: Initial Access
T1190 Exploit Public-Facing Application
Earth Krahang scans public-facing servers aggressively, using recursive searches for folders like .git and .idea, brute-forcing directories, and enumerating subdomains to discover unmaintained or misconfigured assets. They run vulnerability scanners and exploit frameworks such as sqlmap, nuclei, xray, vscan, pocsuite, and wordpressscan to identify weaknesses that grant server access. The group repeatedly abused remote command-execution flaws — notably CVE-2023-32315 (OpenFire) and CVE-2022-21587 (Oracle WADI) [1].
T1199 Trusted Relationship
Earth Krahang exploits trust between governments by compromising government web servers to host backdoors and distributing the download links via spear-phishing emails to other government entities, making the malicious links appear legitimate and potentially bypassing some domain blacklists. The actor leveraged a compromised government email account to send messages to other government entities, using the following subjects in their spear-phishing emails [1]:
|
salary |
They used the following script to send spear‑phishing emails [1]:
|
# 输入Exchange服务器的URL、用户名和密码 |
T1566 Phishing
Earth Krahang also employs spear-phishing emails to target individuals. These emails are designed to deceive recipients into opening attachments or clicking on embedded links, which then trigger the execution of a pre-configured backdoor on the victims' systems. The filenames of these backdoors frequently reference geopolitical topics, reflecting the type of lure favored by the group. Some example files are listed below [1]:
|
"Plan of Action (POA) - TH-VN - TH_Counterdraft_as of Feb 2022.doc.exe"
|
Tactic: Execution
T1059.006 Command and Scripting Interpreter: Python
A Python script was identified that the Earth Krahang group used to exfiltrate emails from a Zimbra mail server by packaging the victim's mailbox through the server API with a stolen authenticated cookie [1]:
|
def getFile(email, cookies): |
Tactic: Persistence
T1133 External Remote Services
The threat actor installs SoftEther VPN on compromised public‑facing servers, using certutil commands to download and install the VPN server binary [1]. By running SoftEther as an external remote service, they establish persistent access to the victim's network. This access lets the actor connect back into the environment to carry out post‑exploitation activity such as lateral movement and data exfiltration [1].
Tactic: Privilege Escalation
T1068 Exploitation for Privilege Escalation
The Earth Krahang group exploited software flaws to perform local privilege escalation. They leveraged CVE-2021-4034 (PwnKit), CVE-2021-22555, and CVE-2016-5195 (Dirty COW) to gain elevated rights on Linux systems [1].
Tactic: Defense Evasion
T1036.005 Masquerading: Match s Resource Name or Location
Earth Krahang renamed the SoftEther server executable to taskllst.exe, tasklist.exe, or tasklist_32.exe on Windows and to curl on Linux to make it appear as a legitimate system file [1].
T1574.001 Hijack Execution Flow: DLL
Earth Krahang frequently used Cobalt Strike during the initial stage of attacks. They exploited DLL side‑loading — in one case dropping three files: fontsets.exe (SHA256: 97c668912c29b8203a7c3bd7d5d690d5c4e5da53), faultrep.dll (SHA256: a94d0e51df6abbc4a7cfe84e36eb8f38bc011f46), and faultrep.dat. The legitimate fontsets.exe was abused to side‑load the custom shellcode loader faultrep.dll, which decodes embedded shellcode stored in faultrep.dat; that decoded payload is Cobalt Strike [1].
Tactic: Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Earth Krahang configured RDP to move laterally or maintain access by modifying system settings. They set the Windows Registry key "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections" to 0 to enable Remote Desktop connections [1].
How Picus Simulates Earth Krahang Attacks?
We also strongly suggest simulating Earth Krahang Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for Earth Krahang:
|
Threat ID |
Threat Name |
Attack Module |
|
97377 |
Earth Krahang Threat Group Campaign Malware Download Threat |
Network Infiltration |
|
55182 |
Earth Krahang Threat Group Campaign Malware Email Threat |
Network Infiltration |
|
96617 |
Earth Krahang Threat Group Campaign |
Windows Endpoint |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.
References
[1] "Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks," Trend Micro. Accessed: Oct. 17, 2025. [Online]. Available: https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html
