Loading threat actor…
Earth Kasha is a China-nexus cyber-espionage threat actor tracked as part of, or closely related to, the broader APT10 umbrella, though it is not necessarily identical to legacy APT10. The group has historically targeted public institutions and academia with spear-phishing, and more recent operations expanded to government and advanced-technology organizations in Japan, Taiwan, and India, with additional reporting indicating activity against manufacturing, aviation, and other private-sector targets. Earth Kasha’s tradecraft evolved significantly in campaigns observed from early 2023 through early 2024. In addition to spear-phishing, the actor exploited public-facing applications, including SSL-VPN and file-storage services, to obtain initial access. Post-compromise activity included deployment of multiple backdoors for persistence, credential theft from endpoints and Active Directory infrastructure, lateral movement over SMB and remote administration mechanisms, reconnaissance using legitimate Windows and Microsoft utilities, and staged exfiltration of compressed data. Malware and tooling associated with Earth Kasha include LODEINFO, NOOPDOOR, NOOPLDR, Cobalt Strike, ANEL, and credential-stealing tooling such as MirrorStealer. LODEINFO has been used by the group since at least 2019 and has evolved to support in-memory execution. NOOPDOOR is a more sophisticated backdoor with active and passive communications modes, encrypted modular loading, and anti-analysis features. Reported delivery and persistence methods include DLL sideloading, scheduled tasks, service abuse, and registry-based persistence. Earth Kasha has also used legitimate administrative tools and remote access channels to blend into victim environments. The actor’s operations show overlap with other China-linked intrusion sets, including Earth Tengshe, and reporting has noted possible shared access methods or vulnerability exploitation across the broader Chinese espionage ecosystem. Despite attribution complexity caused by shared tools and techniques, Earth Kasha is assessed as an espionage-focused actor operating against strategic targets in Asia.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A related intrusion set under the broader 'APT10 umbrella' discussed as distinct from legacy APT10, targeting Japan, Taiwan, and India using public-facing application exploitation and spear-phishing.
Earth Kasha is a China-nexus threat actor known for cyber-espionage campaigns primarily targeting Japan, and more recently Taiwan and India, focusing on advanced technology and government sectors. They use custom malware (LODEINFO, NOOPDOOR, MirrorStealer), Cobalt Strike, and exploit public-facing application vulnerabilities for initial access. Their operations include credential theft, lateral movement, and data exfiltration.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.