- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2020
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0295 · earth-longzhi
ChinaWhat it is
Earth Longzhi is a subgroup of APT41 targeting organizations based in Taiwan, Thailand, the Philippines, and Fiji, and using “stack rumbling” via Image File Execution Options (IFEO), a new denial-of-service (DoS) technique to disable security software.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- SnakeCharmer
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- China, Fiji, Indonesia, Malaysia, Pakistan, Philippines, Taiwan, Thailand, Ukraine
- Sectors
- Aviation, Defense, Education, Financial, Government, Healthcare
Tools
The tools and malware families the sources tie to it.
- BigpipeLoader
- Cobalt Strike
- CroxLoader
- MultiPipeLoader
- OutLoader
- Symatic Loader
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de