Earth Krahang

Search IOCs, vulnerabilities, APT…

216.73.216.6

← Back to intrusion sets

· Published 21/12/2025 03:33 · Modified 21/12/2025 03:33 · Source: AlienVault

Essential information

Confidence: 100/100
Published: 21/12/2025 03:33
Modified: 21/12/2025 03:33
Updated at: 21/12/2025 03:33
Revoked: No
Author / Source: AlienVault
Resource level: —
Primary motivation: —
Related entities: 6 attack patterns (mitre), 10 malware, 7 sectors, 4 countries, 116 indicators, 6 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (6)

T1027 uses

Obfuscated Files or Information MITRE
T1204 uses

User Execution MITRE
T1055 uses

Process Injection MITRE
T1071 uses

Application Layer Protocol MITRE
T1036 uses

Masquerading MITRE
T1064 uses

Scripting MITRE

Malware (10)

POISONPLUG.SHADOW uses

Family
DinodasRAT uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Cobalt Strike - S0154 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
XDealer uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Linodas uses
PlugX - S0013 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
ShadowPad - S0596 uses

Family
Korplug uses

The MITRE Corporation Confidence 100

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
CORESHELL uses

Family The MITRE Corporation Confidence 100

[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January…

First seen 01/01/1970 · Last seen 16/11/5138 ·
CORESHELL - S0137 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

Sectors (7)

Government targets
Finance targets
Technology targets
Defense ministries (including the military) targets
Retail targets
Healthcare targets
Manufacturing targets

Countries (4)

South Africa targets
United States of America targets
American Samoa targets
Central African Republic targets

Indicators (116)

f4ea99dc41cb7922d01955eef9303ec3a24b88c3318138855346de1e830ed09e indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
992d3df19c453a84b5b46c5742fb22686c65eb48cfc71b0bbc7e94c0ef13e66e indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
bb6afc28d610bfddcd0cf3497c152c081f63137fea9914a1fd461a0706c74288 indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
bc422a4e1b6a351ac6fe73d496015cfa6a9dbd5e38566c6f44a59faff83ee95a indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
d176951b9ff3239b659ad57b729edb0845785e418852ecfeef1669f4c6fed61b indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
2e3645c8441f2be4182869db5ae320da00c513e0cb643142c70a833f529f28aa indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
b3a6dfc196bdad381c18f9f861f8da3757479cec2a76b8e5908da5aaec072dd8 indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
05b63707ca3cad54085e521aee84c7472ff7b3fe05e22fd65c8e2ee6f36c6243 indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
521b3add2ab6cee5a5cfd53b78e08ef2214946393d2a156c674606528b05763a indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
update.centos-yum.com indicates

stix 100/100 Revoked

· Valid until 01/07/2025 · Source: AlienVault
36acdaceb9abfcf9923378c44037cc5df8aac03406d082d552e96462121c4ac1 indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault
10b2a7c9329b232e4eef81bac6ba26323e3683ac1f8a99d3a9f8965da5036b6f indicates

stix 100/100 Revoked

· Valid until 21/06/2025 · Source: AlienVault

← Previous

Page / 10

1–12 of 116

Vulnerabilities (CVE) (6)

CVE-2022-21587 KEV targets

9.8 Critical

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications …

Attack vector: Network
Published: 02/02/2023
Modified: 21/12/2025

CVE-2024-21412 KEV targets

8.1 High

Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.

Attack vector: Network
Published: 13/02/2024
Modified: 27/05/2026

CVE-2021-4034 KEV targets

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

Published: 27/06/2022
Modified: 20/12/2025

CVE-2016-5195 KEV targets

7.0 High

Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.

Attack vector: LOCAL
Complexity: HIGH
Published: 10/11/2016
Modified: 22/04/2026

CWE-362

CVE-2021-22555 KEV targets

Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap …

Published: 06/10/2025
Modified: 21/12/2025

CVE-2023-32315 KEV targets

8.6 High

Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console …

Attack vector: Network
Published: 24/08/2023
Modified: 21/12/2025

Contact About Legal notice Privacy policy Terms of use