Custom Arsenal Developed to Target Multiple Industries

Earth Lamia is an advanced persistent threat (APT) actor active since 2023, targeting organizations primarily in Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, notably SQL injection, to gain initial access. They have developed custom malware tools such as the PULSEPACK backdoor and BypassBoss for privilege escalation. Their targeting has evolved from financial services to logistics, online retail, IT companies, universities, and government organizations. Techniques used include DLL sideloading, leveraging legitimate binaries, and modular backdoor deployment. The group's campaigns are linked to other reported activities, indicating a sophisticated and evolving threat actor.

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• PIVOTPIPE: A New .NET-based Unofficial Beacon PayloadMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• VeloCloud Orchestrator SQL Injection VulnerabilityMediumVulnerability2026-10-23
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23