Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

The threat titled "OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions" refers to a persistent and sophisticated cyber espionage campaign attributed to the threat actor group known as Earth Estries. This group has conducted long-term intrusions targeting various sectors including consulting, managed service providers, NGOs, and telecommunications. The campaign leverages multiple known vulnerabilities, notably several Microsoft Exchange Server vulnerabilities from 2021 (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), as well as more recent vulnerabilities such as CVE-2023-46805, CVE-2023-48788, CVE-2024-21887, and CVE-2022-3236. These vulnerabilities primarily enable remote code execution, privilege escalation, and unauthorized access without requiring authentication, allowing attackers to establish persistent footholds within targeted networks. The campaign is characterized by multiple command and control (C&C) infrastructure IP addresses linked to sub-campaigns named Beta (GHOSTSPIDER, DEMODEX) and Alpha (SNAPPYBEE), indicating a complex, multi-stage operation. The threat actor exploits these vulnerabilities to infiltrate networks, exfiltrate sensitive data, and potentially disrupt operations. The use of multiple CVEs spanning several years suggests a long-term, evolving campaign that adapts to newly discovered vulnerabilities to maintain access. The affected countries listed are primarily outside Europe, but the sectors targeted and the vulnerabilities exploited are globally relevant, especially given the widespread use of Microsoft Exchange Server in enterprises worldwide. The campaign's medium severity rating reflects the significant risk posed by these vulnerabilities if exploited, though no known exploits are currently reported in the wild specifically tied to this campaign. The threat actor's focus on high-value sectors and use of multiple sophisticated vulnerabilities underscores the need for vigilance and proactive defense measures.

Detailed information about OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions. Get real-time updates, technical details, and mitigation

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:threat-actor="Earth Estries"'

Filter Threats