UnknownPublished 4 Sep 2024

OSINT · Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Earth Lusca, a threat actor linked to China, is reported to use the KTLVdoor backdoor for multiplatform intrusion. This backdoor enables persistent access across different operating systems, facilitating espionage or data exfiltration. Although no known exploits in the wild or patches are currently available, the threat actor's activity indicates targeted payload delivery. The severity is assessed as low based on current information, but the lack of patches and the multiplatform nature warrant attention. European organizations should be aware of potential indirect risks, especially those with ties to Chinese entities or operating in sensitive sectors. Mitigation should focus on enhanced monitoring for unusual backdoor activity and network segmentation. Countries with significant Chinese business presence or geopolitical interest in China-related cyber activities are more likely to be affected. Overall, defenders should prioritize threat intelligence integration and proactive detection mechanisms to mitigate potential future exploitation.

Impact

For European organizations, the direct impact of Earth Lusca's KTLVdoor backdoor is currently limited, as the primary targeting appears to be within China. However, European entities with business ties to Chinese companies, involvement in supply chains, or operating in sectors of strategic interest (e.g., technology, telecommunications, critical infrastructure) could face indirect risks. The multiplatform capability of the backdoor increases the attack surface, potentially affecting diverse IT environments common in European enterprises. If exploited, the backdoor could lead to unauthorized access, data theft, espionage, and disruption of operations. The absence of patches means that once detected, remediation may require manual removal and system restoration, increasing operational overhead. The stealthy nature of backdoors complicates detection, potentially allowing long-term persistence and data exfiltration. Given geopolitical tensions and the strategic importance of European technology sectors, the threat actor's activity could escalate or pivot to European targets in the future.

Defensive guidance

European organizations should implement advanced endpoint detection and response (EDR) solutions capable of identifying unusual process behaviors and network connections indicative of backdoor activity. Network segmentation should be enforced to limit lateral movement in case of compromise. Regular threat hunting exercises focusing on indicators of compromise related to Earth Lusca and KTLVdoor should be conducted, leveraging threat intelligence feeds from trusted sources like CIRCL and Trend Micro. Multi-factor authentication (MFA) should be mandatory to reduce the risk of credential theft facilitating backdoor deployment. Organizations should maintain strict patch management for all systems to reduce exploitable vulnerabilities that could be leveraged to install backdoors. Additionally, monitoring outbound traffic for anomalous connections to suspicious or unknown external IP addresses can help detect data exfiltration attempts. Employee awareness training on phishing and social engineering can reduce initial infection vectors. Finally, collaboration with national cybersecurity centers and sharing of threat intelligence within European cybersecurity communities will enhance collective defense.

Summary

The threat actor Earth Lusca, attributed to China, has been observed deploying a backdoor named KTLVdoor that supports multiplatform intrusion capabilities. This backdoor allows the attacker to maintain persistent access across various operating systems, which may include Windows, Linux, and possibly macOS, although specific platforms are not detailed. The KTLVdoor backdoor is used for payload delivery, enabling the threat actor to execute commands, exfiltrate data, or move laterally within compromised networks. The intelligence is derived from open-source intelligence (OSINT) feeds, specifically from CIRCL and Trend Micro, indicating ongoing monitoring of this actor's tactics. No patches or known exploits in the wild have been reported, suggesting either a low detection rate or limited deployment so far. The threat actor's focus appears to be on targets within China, but the multiplatform nature of the backdoor implies potential for broader impact. The lack of detailed technical indicators or CVEs limits the ability to perform signature-based detection, emphasizing the need for behavioral analysis and anomaly detection. The threat is currently assessed as low severity due to limited evidence of widespread exploitation and impact, but the persistent and stealthy nature of backdoors necessitates vigilance.

Indicators of compromise

Domains 156

39.105.121.123
39.105.121.123
39.107.101.26
39.107.101.26
47.94.223.124
47.94.223.124
47.94.166.190
47.94.166.190
59.110.136.109
59.110.136.109

URLs 81

39.105.121.123:9999
39.107.101.26:9999
47.94.223.124:9999
47.94.166.190:9999
59.110.136.109:9999
123.56.45.175:81
123.57.223.22:81
39.107.75.91:81
182.92.101.4:81
123.56.45.175:443

Hashes 27

9ceb37c55a1e55afe50e2b892d3756e5c89ee71131245f5da72c1b8dd0005b99Backdoor SHA256 hashes
6eec892054e6cb1addbde2fa92d3ccb5d56d37aa992f81f9106aaf124b9d3525Backdoor SHA256 hashes
20f09959706797b81b2a4de627c01d0c0d890d142954d455a0e50f7811bdc951Backdoor SHA256 hashes
7ff329e0a20a96dd4d0e8b42a216ade348161566250b7e39e166031c881f34d0Backdoor SHA256 hashes
12435ae8d190c4a0cae64009416f17195dbb7f7ca732b69e6178e9dd4c66fcb2Backdoor SHA256 hashes
19f94c523d4488a50584dd3d96500820e4f479cadcef4d14a1dd7cf939cd3154Backdoor SHA256 hashes
dc4277e5f6e76ef3f5c0da8a6703acd69a017747aac0413f7248911e51214641Backdoor SHA256 hashes
b66dab4fbdae54eea59313fd218abc96a54c0bbf0ab774dbe8776de9322510b2Backdoor SHA256 hashes
d095e636400ee633ae22488bba77d53f584f1ff279fd604bb6e60c0211d1957eBackdoor SHA256 hashes
99027cf9f6fcce91d1d08a8cc15043912e51aff82804d4678c7b453e55899404Backdoor SHA256 hashes

Port 81

9999
9999
9999
9999
9999
81
81
81
81
443

Text 84

39.105.121.123
39.107.101.26
47.94.223.124
47.94.166.190
59.110.136.109
123.56.45.175
123.57.223.22
39.107.75.91
182.92.101.4
123.56.45.175

Link 1

https://www.trendmicro.com/en_us/research/24/i/earth-lusca-ktlvdoor.html

File 1

Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion _ Trend Micro (US).pdf

Community reviews

Loading reviews…