Earth Minotaur

Earth Minotaur is a Chinese threat activity cluster tracked by Trend Micro. Reporting directly attributes to it the use of the MOONSHINE exploit kit and development/use of the DarkNimbus Android backdoor, also referred to as DarkNights in some reporting. Earth Minotaur primarily targets Tibetan and Uyghur communities, using social engineering messages in instant messaging applications, especially WeChat, to lure victims to malicious links. MOONSHINE attack links can masquerade as legitimate content, redirect victims back to benign pages after exploitation, and target vulnerable Chromium-based browsers and Tencent Browser Server components in Android applications, including WeChat. Reported MOONSHINE exploitation targeted multiple known Chromium vulnerabilities and was assessed as still under active development. In observed chains, successful exploitation installed a trojanized XWalk component containing DarkNimbus. DarkNimbus has Android and Windows variants; the Android variant supports extensive surveillance and data theft, including device, communications, location, file, screenshot, photo, recording, and foreground messaging-app conversation collection, while the Windows variant supports host profiling, installed software enumeration, file collection, browsing history theft, screenshots, keystroke capture, clipboard theft, shell execution, and browser credential theft. Cisco Talos also linked Earth Minotaur to the DKnife gateway-monitoring/adversary-in-the-middle framework and noted overlap with tooling also used by the China-aligned APT group TheWizards. Content also states DarkNimbus developed by Earth Minotaur was later used by TheWizards. Known alias directly mentioned in the content: DarkNights (for DarkNimbus).