Earth Krahang

Earth Krahang is a Chinese-nexus cyber espionage threat actor active since at least early 2022 and primarily focused on government targets, especially ministries and foreign affairs organizations. The group has conducted broad campaigns across Southeast Asia, Africa, South America, Europe, and other regions, with a strong concentration on Southeast Asian government entities. Reporting has identified more than one hundred targeted entities across dozens of countries, with confirmed victims including numerous government organizations. Earth Krahang typically gains initial access through spear-phishing and exploitation of public-facing servers, including repeated abuse of vulnerabilities in Openfire and Oracle server software. The actor also performs reconnaissance and scanning against exposed services and repositories, harvests large volumes of email addresses, and leverages compromised government infrastructure to attack additional victims. A notable operational pattern is the abuse of compromised government web servers and email accounts to host payloads, proxy traffic, and send phishing messages to other government organizations, exploiting intergovernmental trust relationships to improve delivery and reduce suspicion. The group’s malware and tooling include PlugX, ShadowPad, Cobalt Strike, ReShell, and XDealer, also known as DinodasRAT, including Linux variants such as Linodas. Earth Krahang has used bespoke backdoors for command execution, file operations, information collection, and encrypted command-and-control, and has shown cross-platform capability against both Windows and Linux systems. Linux-focused tooling associated with the actor includes mature server-oriented backdoor functionality, persistence mechanisms, reverse shell support, proxying, service and process control, and artifact-hiding behavior resembling a rudimentary rootkit. Post-compromise activity includes credential theft, mailbox theft, privilege escalation, lateral movement, persistence, and exfiltration. Earth Krahang has brute-forced mail services to obtain credentials, dumped credentials from compromised Windows systems, accessed local credential stores, enabled remote access, installed VPN software on compromised edge or public-facing servers, and used administrative tooling for internal reconnaissance and remote execution. The actor has also exploited both Windows and Linux privilege-escalation vulnerabilities and used scheduled tasks and other mechanisms to maintain access. Earth Krahang is strongly linked to the China-nexus actor Earth Lusca, also known as RedHotel, and some assessments indicate the two may be managed by the same operator set. Multiple reports have also connected Earth Krahang activity to the Chinese contractor I-Soon, although the exact organizational relationship is not fully conclusive. Additional activity clusters, including the PONDSNAKE campaign, have been attributed to Earth Krahang with medium-to-high confidence based on shared tooling, infrastructure patterns, and tradecraft. Overall, Earth Krahang is best characterized as a state-aligned espionage actor focused on long-term access to government networks, email collection, and strategic intelligence gathering.