Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

The provided information pertains to an OSINT (Open Source Intelligence) report titled "Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions," associated with the threat actor group "Earth Estries." The report highlights a prolonged cyber intrusion campaign targeting multiple sectors including consulting, managed services providers, NGOs, and telecommunications. The affected countries span a wide geographic range, including Afghanistan, Brazil, Eswatini, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, the United States, and Vietnam. The nature of the threat is categorized as OSINT with a low severity rating and a 50% certainty level, indicating moderate confidence in the findings. No specific affected product versions or technical exploit details are provided, and no patches or known exploits in the wild have been identified. The campaign appears to involve network activity and external analysis, suggesting reconnaissance and possibly persistent intrusion techniques. The lack of CVEs beyond CVE-2023-46805 and absence of CWE identifiers imply that the threat is more related to espionage or intrusion activity rather than a specific software vulnerability. The technical details are minimal, with only a UUID and a timestamp, limiting deeper technical analysis. Overall, this represents a long-term cyber intrusion campaign by a known threat actor group with a broad international footprint and targeting critical sectors, but with limited technical specifics and low immediate severity.

Detailed information about OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions. Get real-time updates, technical details, and mitigation

OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat titled "OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions" refers to a persistent and sophisticated cyber espionage campaign attributed to the threat actor group known as Earth Estries. This group has conducted long-term intrusions targeting various sectors including consulting, managed service providers, NGOs, and telecommunications. The campaign leverages multiple known vulnerabilities, notably several Microsoft Exchange Server vulnerabilities from 2021 (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), as well as more recent vulnerabilities such as CVE-2023-46805, CVE-2023-48788, CVE-2024-21887, and CVE-2022-3236. These vulnerabilities primarily enable remote code execution, privilege escalation, and unauthorized access without requiring authentication, allowing attackers to establish persistent footholds within targeted networks. The campaign is characterized by multiple command and control (C&C) infrastructure IP addresses linked to sub-campaigns named Beta (GHOSTSPIDER, DEMODEX) and Alpha (SNAPPYBEE), indicating a complex, multi-stage operation. The threat actor exploits these vulnerabilities to infiltrate networks, exfiltrate sensitive data, and potentially disrupt operations. The use of multiple CVEs spanning several years suggests a long-term, evolving campaign that adapts to newly discovered vulnerabilities to maintain access. The affected countries listed are primarily outside Europe, but the sectors targeted and the vulnerabilities exploited are globally relevant, especially given the widespread use of Microsoft Exchange Server in enterprises worldwide. The campaign's medium severity rating reflects the significant risk posed by these vulnerabilities if exploited, though no known exploits are currently reported in the wild specifically tied to this campaign. The threat actor's focus on high-value sectors and use of multiple sophisticated vulnerabilities underscores the need for vigilance and proactive defense measures.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:country="united states of america"'

Filter Threats