Full Report
Earth Lamia, a suspected China-nexus APT group active since at least 2023, has expanded its cyber espionage campaigns across Brazil, India, and Southeast Asia. The group targets multiple industries — shifting from financial services to logistics, online retail, and currently I...
Analysis Summary
# Threat Actor: Earth Lamia
## Attribution & Identity
**Actor Identification:** Suspected China-nexus APT group.
**Known Aliases:** Earth Lamia.
## Activity Summary
Earth Lamia has been active since at least 2023. The group has significantly expanded its cyber espionage campaigns into Brazil, India, and Southeast Asia. The group has shown an evolution in targeting, shifting from initial focus on financial services to targeting logistics, online retail, and more recently, IT, government, and academic institutions. They focus on exploiting publicly accessible web application vulnerabilities for initial access and developing custom malware for evasion.
## Tactics, Techniques & Procedures
- **Initial Access:** Exploits 1-day vulnerabilities in web applications, specifically mentioning SQL injection and exploitation of known CVEs (e.g., CVE-2017-9805, CVE-2021-22205).
- **Defense Evasion/Persistance:** Deploys custom malware, sideloads malware-laced DLLs into trusted executables (e.g., AppLaunch.exe). Establishes persistence via scheduled tasks and the creation of new administrative application users.
- **Privilege Escalation:** Uses custom tools like BypassBoss (based on Sharp4PrinterNotifyPotato) and known techniques like godpotato/JuicyPotato.
- **Credential Access:** Performs credential dumping via LSASS memory and SAM hive.
- **Lateral Movement:** Utilizes tools such as Fscan, certutil.exe, powershell.exe, and rakshasa.
- **Command and Control (C2):** Uses Cobalt Strike and the latest version of their custom backdoor, PULSEPACK, which utilizes WebSocket-based C2 and dynamically loads encrypted plugins.
- **Exfiltration:** Data exfiltration is a primary observed impact.
- **Specific Vulnerabilities Exploited:**
- CVE-2017-9805 (Apache Struts2)
- CVE-2021-22205 (GitLab)
- CVE-2024-9047, -27198, -27199, -51378, -51567, -56145 (WordPress, JetBrains TeamCity, CyberPanel, Craft CMS)
- CVE-2025-31324 (SAP NetWeaver)
## Targeting
- **Sectors:** Financial services (historical), Logistics, Online Retail, IT, Government, and Academic Institutions (current focus).
- **Geography:** Brazil, India, and Southeast Asia.
- **Victims:** Specific organizations were not named, but the targets align with the sectors listed above across the specified geography.
## Tools & Infrastructure
- **Malware Families Used:** PULSEPACK (.NET-based modular backdoor with WebSocket C2), Vshell, Brute Ratel.
- **Custom Tools:** BypassBoss (Privilege Escalation).
- **Infrastructure/C2:** Cobalt Strike, PULSEPACK (uses WebSocket C2 and dynamically loads encrypted Base64 plugins transmitting data with AES encryption).
- **Internal Observation:** Fscan, powershell.exe, certutil.exe, rakshasa.
## Implications
Earth Lamia is a sophisticated, highly active cyber espionage group demonstrating rapid adaptation by consistently targeting 1-day web vulnerabilities for initial access and continually refining its custom toolset (PULSEPACK) to maintain stealth and operational security, posing a significant threat to organizations operating critical infrastructure and government services in the APAC region and Latin America.
## Mitigations
- Patching public-facing applications immediately, especially for known vulnerabilities listed (CVEs).
- Implement strict controls over application user creation and monitor for newly created administrative accounts.
- Deploy advanced endpoint protection capable of monitoring for suspicious process injection/sideloading techniques into trusted executables like AppLaunch.exe.
- Monitor for C2 communications utilizing dynamic or encrypted protocols like WebSockets.
- Conduct routine credential dumping monitoring (LSASS access) and network scans associated with lateral movement tools (Fscan).