- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2019
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0513 · earth-minotaur
ChinaWhat it is
(Trend Micro) We believe that Earth Minotaur is an intrusion set which hasn’t been publicly reported. In the first report of MOONSHINE exploit kit in 2019, the threat actor using the toolkit was named 'Poison Carp, Evil Eye'. While both used the MOONSHINE exploit kit and had similar targets, we did not find further connections between Earth Minotaur and POISON CARP. The backdoor DarkNimbus had been developed in 2018 but was not found in any of POISON CARP’s previous activity. Therefore, we categorized them as two different intrusion sets.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- ThreatActor.info (Malpedia et al.)China
Tools
The tools and malware families the sources tie to it.
- DarkNimbus
- MOONSHINE
Sources
- ETDA Threat Group Card apt.etda.or.th