The 'Game of Emperor' report reveals a long-term cyber intrusion campaign attributed to the threat actor 'Earth Estries,' targeting multiple sectors including consulting, managed service providers, NGOs, and telecoms across various countries primarily outside Europe. The campaign appears to be persistent and ongoing, with a low severity rating and no known exploits or patches available. The threat actor's activity has been observed in countries such as Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. Although no direct European targets are listed, the sectors affected and the global nature of managed service providers and telecoms imply potential indirect risks to European organizations. The lack of detailed technical indicators and the unknown nature of the threat limit precise mitigation steps, but vigilance and enhanced monitoring of supply chains and third-party providers are recommended. Given the low severity and absence of known exploits, the threat is assessed as medium severity due to its persistence and potential for indirect impact.
Earth Lusca, a threat actor linked to China, is reported to use the KTLVdoor backdoor for multiplatform intrusion. This backdoor enables persistent access across different operating systems, facilitating espionage or data exfiltration. Although no known exploits in the wild or patches are currently available, the threat actor's activity indicates targeted payload delivery. The severity is assessed as low based on current information, but the lack of patches and the multiplatform nature warrant attention. European organizations should be aware of potential indirect risks, especially those with ties to Chinese entities or operating in sensitive sectors. Mitigation should focus on enhanced monitoring for unusual backdoor activity and network segmentation. Countries with significant Chinese business presence or geopolitical interest in China-related cyber activities are more likely to be affected. Overall, defenders should prioritize threat intelligence integration and proactive detection mechanisms to mitigate potential future exploitation.
The Hagga threat actor is suspected of abusing the FSociety framework for payload delivery, though details remain unclear and the certainty of this information is moderate (50%). There is no confirmed exploit or patch available, and the threat type is currently classified as unknown. The FSociety framework is known as an open-source penetration testing tool that can be repurposed by malicious actors for payload delivery. The medium severity rating reflects potential risks associated with payload delivery frameworks being leveraged by threat actors. European organizations should be vigilant, especially those in sectors commonly targeted by such actors. Mitigation requires enhanced monitoring for unusual use of penetration testing tools and restricting unauthorized use of frameworks like FSociety. Countries with higher adoption of penetration testing tools and significant critical infrastructure may be more at risk. Given the lack of confirmed exploits and limited technical details, the suggested severity is medium, emphasizing caution but not indicating immediate critical threat. Defenders should focus on detection and prevention of unauthorized tool usage and maintain strong endpoint security controls.
