Earth Krahang is a hacking group that this post describes as China-based and as running a campaign against governments since early 2022. The Record reports at least 70 victims across 23 countries. It exploits server flaws such as CVE-2023-32315 in Openfire and CVE-2022-21587 in Oracle web apps, and it also sends spear-phishing emails.
Who does Earth Krahang target?
A sophisticated hacking campaign has been underway since early 2022 by a China-based advanced persistent threat group known as Earth Krahang. According to The Record, the campaign has attacked at least 70 victims across 23 countries, mainly in Southeast Asia, with further victims in Europe, America and Africa. Foreign Affairs ministries and departments were among the top targets, along with telecommunications providers, post offices, logistics platforms and job services.
How does Earth Krahang get into networks?
The methods employed by Earth Krahang in their attacks involve exploiting specific vulnerabilities such as CVE-2023-32315 (Openfire) and CVE-2022-21587 (Oracle Web Apps) to target publicly accessible servers, deploying customized backdoors, and conducting spear-phishing attacks for cyber espionage. The threat actors set up VPN servers on compromised servers to reach private networks and carry out brute-force attacks against government email accounts.
Which tools does Earth Krahang use?
Earth Krahang’s attacks aim to establish a presence and maneuver within victim networks, using two custom backdoors, Reshell and XDealer. According to The Record, Reshell collects information, drops files and runs commands, while XDealer works on Windows and Linux.