{
  "name": "Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear",
  "slug": "cyberespionage-group-earth-hunduns-continuous-refinement-of-waterbear-and-deuterbear",
  "description": "This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a persistent cyberespionage group targeting organizations in the Asia-Pacific region. The malware, known as Waterbear and its latest iteration, Deuterbear, have undergone significant enhancements, incorporating anti-analysis mechanisms, complex encryption routines, and evasion techniques. The report provides an in-depth examination of the malware's attack chains, tactics, techniques, and procedures, shedding light on the group's advanced capabilities and relentless efforts to maintain a stealthy presence within compromised environments.",
  "published": "2024-05-21T09:24:05+00:00",
  "created_at": "2024-05-21T09:24:05+00:00",
  "modified_at": "2024-05-21T09:37:51+00:00",
  "created_at_opencti": "2024-05-21T09:24:05+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-21",
    "anti-analysis",
    "cyberespionage",
    "deuterbear",
    "encryption",
    "evasion",
    "malware",
    "waterbear"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "http://suitsvm003.rchitecture.org:443"
      },
      {
        "id": "",
        "name": "http://smartclouds.gelatosg.com:443"
      },
      {
        "id": "",
        "name": "http://showgyella.quadrantbd.com:443"
      },
      {
        "id": "",
        "name": "http://rscvmogt.taishanlaw.com:443"
      },
      {
        "id": "",
        "name": "http://freeprous.bakhell.com:443"
      },
      {
        "id": "",
        "name": "http://cloudsrm.gelatosg.com:443"
      },
      {
        "id": "",
        "name": "http://cloudflaread.quadrantbd.com:443"
      },
      {
        "id": "",
        "name": "suitsvm003.rchitecture.org"
      },
      {
        "id": "",
        "name": "smartclouds.gelatosg.com"
      },
      {
        "id": "",
        "name": "showgyella.quadrantbd.com"
      },
      {
        "id": "",
        "name": "rscvmogt.taishanlaw.com"
      },
      {
        "id": "",
        "name": "freeprous.bakhell.com"
      },
      {
        "id": "",
        "name": "cloudsrm.gelatosg.com"
      },
      {
        "id": "",
        "name": "cloudflaread.quadrantbd.com"
      },
      {
        "id": "",
        "name": "e669aaf63552430c6b7c6bd158bcd1e7a11091c164eb034319e1188d43b5490c"
      },
      {
        "id": "",
        "name": "e483cae34eb1e246c3dd4552b2e71614d4df53dc0bac06076442ffc7ac2e06b2"
      },
      {
        "id": "",
        "name": "dc60d8b1eff66bfb91573c8f825695e27b0813a9891bd0541d9ff6a3ae7e8cf2"
      },
      {
        "id": "",
        "name": "d6ac4f364b25365eb4a5636beffc836243743ecf7ef4ec391252119aed924cab"
      },
      {
        "id": "",
        "name": "d665aea7899ad317baf1b6e662f40a10d42045865f9eea1ab18993b50dd8942d"
      },
      {
        "id": "",
        "name": "ca0423851ee2aa3013fe74666a965c2312e42d040dbfff86595eb530be3e963f"
      },
      {
        "id": "",
        "name": "c97e8075466cf91623b1caa1747a6c5ee38c2d0341e0a3a2fa8fcf5a2e6ad3a6"
      },
      {
        "id": "",
        "name": "ab8d60e121d6f121c250208987beb6b53d4000bc861e60b093cf5c389e8e7162"
      },
      {
        "id": "",
        "name": "a569df3c46f3816d006a40046dae0eb1bc3f9f1d4d3799703070390e195f6dd4"
      },
      {
        "id": "",
        "name": "8f26069b6b49391f245b8551aa42ca4814c52e7f52d0343916f5262557bf5c52"
      },
      {
        "id": "",
        "name": "74efa0ce94f4285404108d3d19bf2ff64c7c3a1c85e9b59cf511b56f9d71dc05"
      },
      {
        "id": "",
        "name": "6dcc3af7c67403eaae3d5af2f057f0bb553d56ec746ff4cb7c03311e34343ebd"
      },
      {
        "id": "",
        "name": "4540132def6dfa6d181cabf1e1689bede5ecfef6450b033fecb0aeb1fe1b3fe9"
      },
      {
        "id": "",
        "name": "0da9661ed1e73a58bd1005187ad9251bcdea317ca59565753d86ccf1e56927b8"
      },
      {
        "id": "",
        "name": "6b9a14d4d9230e038ffd9e1f5fd0d3065ff0a78b52ab338644462864740c2241"
      }
    ],
    "malware": [
      {
        "id": "c8cf1da2-344a-4514-835c-3b273e5f9d54",
        "name": "Deuterbear",
        "slug": "deuterbear"
      },
      {
        "id": "a5fc3db7-0f67-4f51-8e7d-fa596da4dff3",
        "name": "Waterbear - S0579",
        "slug": "waterbear-s0579"
      }
    ],
    "intrusion_sets": [
      {
        "id": "ff1973b0-d082-4406-ace7-deb4abbae8b5",
        "name": "Earth Hundun",
        "slug": "earth-hundun"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/d/cyberespionage-group-earth-hundun%27s-continuous-refinement-of-waterbear-and-deuterbear/ioc-earth-hundun.txt",
    "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html",
    "https://otx.alienvault.com/pulse/664c845591d8e888e83af16f"
  ]
}