AnalysisPublished 27 Nov 2024

OSINT · Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

The 'Game of Emperor' report details a persistent cyber intrusion campaign by the threat actor 'Earth Estries' targeting sectors such as consulting, managed service providers, NGOs, and telecoms. The campaign affects multiple countries primarily outside Europe, including Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. There are no known exploits or patches associated with this threat. The campaign is ongoing but assessed as medium severity due to its persistence and potential indirect risks to European organizations through global supply chains.

Impact

The campaign's impact includes persistent unauthorized access or intrusion into targeted sectors across multiple countries. Although no direct European targets are identified, the involvement of globally interconnected sectors like managed service providers and telecoms suggests potential indirect exposure. No known exploits or vulnerabilities are reported, and the severity is considered medium due to the campaign's persistence rather than immediate critical damage.

Defensive guidance

No specific patches or fixes are available for this threat. Due to the lack of detailed technical indicators, organizations are advised to maintain vigilance, particularly regarding supply chain and third-party provider security. Enhanced monitoring and threat detection focused on these sectors may help mitigate potential indirect impacts. Follow vendor advisories and threat intelligence updates for any new developments.

Summary

This threat intelligence report describes a long-term cyber intrusion campaign attributed to the 'Earth Estries' threat actor. The campaign targets multiple sectors including consulting, managed service providers, NGOs, and telecoms across various countries mainly outside Europe. The activity is persistent and ongoing, with no known exploits or patches available. Technical details and indicators are not provided, limiting precise mitigation. The global nature of the targeted sectors implies potential indirect risks to organizations beyond the directly affected countries.

Indicators of compromise

IP addresses 23

139.59.108.43Campaign Beta (GHOSTSPIDER)
185.105.1.243Campaign Beta (GHOSTSPIDER)
143.198.92.175Campaign Beta (GHOSTSPIDER)
139.99.114.108Campaign Beta (GHOSTSPIDER)
139.59.236.31Campaign Beta (GHOSTSPIDER)
104.194.153.65Campaign Beta (GHOSTSPIDER)
45.125.67.144Campaign Beta (DEMODEX)
43.226.126.164Campaign Beta (DEMODEX)
172.93.165.10Campaign Beta (DEMODEX)
193.239.86.168Campaign Beta (DEMODEX)

Hashes 10

1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296
05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870
b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac
6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc
25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c
16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266
2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdecDEMODEX PowerShell dropper
fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098SNAPPYBEE payload
fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5SNAPPYBEE loader

Vulnerability 15

CVE-2023-46805
CVE-2024-21887
CVE-2023-48788
CVE-2022-3236
CVE-2021-26855
CVE-2021-26857
CVE-2021-26858
CVE-2021-27065
CVE-2021-27065
CVE-2021-26858

Link 15

https://www.trendmicro.com/en_us/research/24/k/earth-estries.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065
http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855
http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html
http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html

Text 104

- Earth Estries, a Chinese APT group, has primarily targeted critical sectors like telecommunications and government entities across the US, Asia-Pacific, Middle East, and South Africa since 2023. - The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities. - Earth Estries exploits public-facing server vulnerabilities to establish initial access and uses living-off-the-land binaries for lateral movement within networks to deploy malware and conduct long-term espionage. - The group has compromised over 20 organizations, targeting various sectors including telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies and NGOs in numerous countries. - Earth Estries uses a complex C&C infrastructure managed by different teams, and their operations often overlap with TTPs of other known Chinese APT groups, indicating possible use of shared tools from malware-as-a-service providers
Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions
Blog
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Stable
Base
76

Datetime 14

2024-07-25T17:34:00+00:00
2021-03-03T00:15:00+00:00
2024-07-25T17:53:00+00:00
2021-03-03T00:15:00+00:00
2024-07-25T17:53:00+00:00
2021-03-03T00:15:00+00:00
2024-02-15T20:18:00+00:00
2021-03-03T00:15:00+00:00
2024-07-25T17:53:00+00:00
2021-03-03T00:15:00+00:00

Float 7

Cpe 227

cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*

Weakness 91

CWE-22
CWE-15
CWE-22
CWE-23
CWE-264
CWE-272
CWE-285
CWE-346
CWE-348
CWE-59

Yara 2

rule Backdoor_GHOSTSPIDER_beacon_loader { meta: author = "Trend Micro Research" strings: $clr = { C7 45 ?? 43 4C 52 43 C7 45 ?? 72 65 61 74 C7 45 ?? 65 49 6E 73 C7 45 ?? 74 61 6E 63 } $chunk1 = { C1 EA ?? 0F B6 D2 8B 34 95 ?? ?? ?? ?? 8B 55 ?? C1 EA ?? 8B 14 95 ?? ?? ?? ?? C1 E9 ?? 0F B6 F9 33 34 BD ?? ?? ?? ?? 8B 7D ?? 89 75 ?? 31 55 ?? 0F B6 55 ?? 8B 75 ?? 33 34 95 ?? ?? ?? ?? 8B D3 33 B0 ?? ?? ?? ?? } $chunk2 = { 41 0F B6 1B 41 8B C2 99 41 F7 F9 48 63 C2 0F B6 4C 05 ?? 44 03 C1 44 03 C3 } condition: uint16(0) == 0x5a4d and filesize < 300KB and ( $clr and any of ($chunk*) ) }
rule Backdoor_GHOSTSPIDER_stager { meta: author = "Trend Micro Research" strings: $s1 = "new_comp" ascii wide $s2 = "del_comp" ascii wide $s3 = "new_client" ascii wide $s4 = "del_client" ascii wide $s5 = "new_base" ascii wide $s6 = "del_base" ascii wide $cookie = "phpsessid=%s; b=%d; path=/; expires=%s" ascii wide condition: uint16(0) == 0x5a4d and filesize < 300KB and ( $cookie and 2 of ($s*) ) }

File 10

dbindex.dat
imfsbDLL.dll
DgApi.dll
imfsbDLL.dll
DgApi.dll
%WINDIR%\System32\SstpCfs.dll
%WINDIR%\System32\drivers\dumpfiskfss.sys
onedrived.ps1DEMODEX PowerShell dropper
NortonLog.txtSNAPPYBEE payload
WINMM.dllSNAPPYBEE loader

X509 fingerprint sha256 1

2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31

Community reviews

Loading reviews…