Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear
Essential information
- Published
- 21/05/2024 11:24
- Modified
- 21/05/2024 11:37
- Tags
- 2024-05-21 anti-analysis cyberespionage deuterbear encryption evasion malware waterbear
- Related entities
- 29 observables, 1 intrusion sets (apt), 2 malware, 2 others
Description
This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a persistent cyberespionage group targeting organizations in the Asia-Pacific region. The malware, known as Waterbear and its latest iteration, Deuterbear, have undergone significant enhancements, incorporating anti-analysis mechanisms, complex encryption routines, and evasion techniques. The report provides an in-depth examination of the malware's attack chains, tactics, techniques, and procedures, shedding light on the group's advanced capabilities and relentless efforts to maintain a stealthy presence within compromised environments.
External references
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/d/cyberespionage-group-earth-hundun%27s-continuous-refinement-of-waterbear-and-deuterbear/ioc-earth-hundun.txt
- https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html
- https://otx.alienvault.com/pulse/664c845591d8e888e83af16f