Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.

Earth Kasha, an Advanced Persistent Threat (APT) group linked to APT10, has initiated a new cyber espionage campaign in March 2025 targeting government agencies and public institutions primarily in Taiwan and Japan. The campaign employs spear-phishing techniques to deliver a sophisticated and updated version of the ANEL backdoor malware. Notably, the updated ANEL backdoor incorporates a new command enabling the execution of Beacon Object Files (BOF) directly in memory, enhancing stealth and evasion capabilities by avoiding disk writes. Additionally, the malware uses SharpHide, a known tool for hiding malicious code within legitimate .NET assemblies, to maintain persistence on compromised systems. The second-stage payload, NOOPDOOR, has been enhanced to support Command and Control (C&C) communications over DNS over HTTPS (DoH), which allows the malware to blend its traffic with legitimate encrypted DNS queries, making detection and blocking more challenging for network defenders. The attack chain begins with compromised email accounts used to send spear-phishing emails containing malicious Excel files. These files exploit social engineering and evasion techniques to bypass security controls and deliver the payload. The campaign demonstrates Earth Kasha's continuous evolution in Tactics, Techniques, and Procedures (TTPs), leveraging advanced evasion, persistence, and covert communication methods to conduct espionage operations. The use of spear-phishing, memory-resident payloads, and encrypted DNS communications indicates a high level of sophistication aimed at long-term infiltration and data exfiltration from sensitive government and public sector targets.

MD5 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc

SHA1 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc

Detailed information about Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Get real-time updates, technical details, and mitigation stra

Title	Severity	Type	Source	Date

Threats Tagged 'anel backdoor'

Filter Threats

Threats Tagged 'anel backdoor'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility