CampaignPublished 1 May 2025Updated 31 May 2025

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

Source AlienVault OTX General

Description

Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.

Impact

For European organizations, especially those involved in government, public administration, or sectors with geopolitical relevance, this threat poses significant risks. Although the campaign currently targets Taiwan and Japan, the advanced techniques and tools used by Earth Kasha could be adapted to target European entities, particularly those with strategic ties or interests in East Asia. The use of spear-phishing and compromised email accounts increases the risk of initial compromise, while the memory-resident execution and DoH-based C&C communications complicate detection and response efforts. Successful infiltration could lead to unauthorized access to sensitive information, espionage, disruption of operations, and potential compromise of critical infrastructure. The stealthy nature of the malware and its persistence mechanisms could allow attackers to maintain long-term access, increasing the potential for data theft and manipulation without immediate detection.

Defensive guidance

European organizations should implement targeted and advanced defensive measures beyond generic advice. These include: 1) Enhancing email security by deploying advanced anti-phishing solutions that analyze email context, sender reputation, and attachment behavior, coupled with user training focused on spear-phishing awareness. 2) Employing endpoint detection and response (EDR) tools capable of detecting in-memory execution and anomalous behaviors such as BOF execution and SharpHide usage. 3) Monitoring DNS traffic for unusual DoH activity, including anomalous query patterns or connections to suspicious domains, and applying DNS filtering and inspection where feasible. 4) Implementing strict application whitelisting and code integrity policies to prevent unauthorized execution of malicious assemblies. 5) Regularly auditing and securing email accounts to prevent compromise, including multi-factor authentication (MFA) and anomaly detection for login behaviors. 6) Conducting threat hunting exercises focused on indicators of compromise related to Earth Kasha’s TTPs and maintaining updated threat intelligence feeds to detect emerging variants. 7) Network segmentation to limit lateral movement and data exfiltration capabilities of attackers.

Indicators of compromise

Hashes 35

016df9e04a1cb43d5d109dccc5144f4bMD5 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc
da30cd4cfa97a12ff679ad2fc05a9c6152645eceSHA1 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc
1e0a7737a484699d035c0568771c4834c0ff3fb9ba87aded3c86705e10e9bb0e
2110b9a4c74d1c8be1aed6ebcff2351cad3d16574026fe4697a9c70810fb1d9e
362b0959b639ab720b007110a1032320970dd252aa07fc8825bb48e8fdd14332
488201c08219f5cbd79d16702fb909d4e8ad8fa76819a21e0f262e2935e58dd2
4f3ec89d5ea0a513afa3f49434f67b7e1540a4a8a93d078def950bd94d444723
517ef26be8b9fb1af0e9780b244827af4937ad2fa4778a0bd2d9c65502ce54e1
63e813b5bf94bdec9ce35c9d7311f76c3a35728d158ade0a6487fc99c73dcf31
69e2a259e0136b61a3acad3f8fad2c012c75c9d8e26e66a3f0af1e7c23506b5c

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Jul 2025, 04:09 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Hashes 35

Community reviews

Related threats