{
  "name": "Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan",
  "slug": "earth-kasha-updates-ttps-in-latest-campaign-targeting-taiwan-and-japan",
  "description": "Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.",
  "published": "2025-05-01T18:32:02+00:00",
  "created_at": "2025-05-01T18:32:02+00:00",
  "modified_at": "2025-05-01T18:57:41+00:00",
  "created_at_opencti": "2025-05-01T18:32:02+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-05-01",
    "anel backdoor",
    "apt10",
    "espionage",
    "sharphide",
    "spear-phishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "192.46.215.56"
      },
      {
        "id": "",
        "name": "172.105.62.188"
      },
      {
        "id": "",
        "name": "139.162.38.102"
      },
      {
        "id": "",
        "name": "fc8c574088af4f74cf84c5c04d522bb1665f548cb17c6192552eb9b783401009"
      },
      {
        "id": "",
        "name": "f502102c5c598d5b9e24f689a3b09b1d2f6702226049a573c421b765867391b3"
      },
      {
        "id": "",
        "name": "eeec3a94500ecd025ecdd559e15e4679e26c1347e534944721abe416b49f3871"
      },
      {
        "id": "",
        "name": "e5b99572581df7a5116511be3f03b9f1a90611235b8288d9f59141876adb1ef1"
      },
      {
        "id": "",
        "name": "e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc"
      },
      {
        "id": "",
        "name": "cf6ed83d7dcc13f500486044d1af606ceb12c387568ccbb498e01cc7d8005dbd"
      },
      {
        "id": "",
        "name": "cb0848d79d2eef76e1d4ff602e0844d03b614d4c25a1b5e3f0ae5c33ea5500b9"
      },
      {
        "id": "",
        "name": "b56aa48721cd1119a9e06ed9c2f923a1dda5f9aa079dc0e4fd66ab37e33649e8"
      },
      {
        "id": "",
        "name": "ad050545b65ecbb2178f678c654d84d14986a77051897927e56b5c2893c33608"
      },
      {
        "id": "",
        "name": "ac8c36075ac0085c7d1e96b3fc08c15a151373186e564486dd91d2e49b2dd287"
      },
      {
        "id": "",
        "name": "a347e1efbfca3722c9e8cc86eba3b288f7e4fae9d386f2a8969faffb125a74c5"
      },
      {
        "id": "",
        "name": "a14c9ae22ca8bdb4971a03f61b2bcc5f140abb51c6922ab7c92ea09ee14dd3bd"
      },
      {
        "id": "",
        "name": "a12a34d329ccc305dca2306e2d698945f1413c013fe99d4bb069db2127f47806"
      },
      {
        "id": "",
        "name": "9e4c155f4d096d9a0529e83fd21197f3dba20cc4eef48045fd018334384dd513"
      },
      {
        "id": "",
        "name": "9c24b60574f39b0565442a79a629a2944672f56acca555e81275e5079382d98b"
      },
      {
        "id": "",
        "name": "9569c4044f8cf32bc9a0513ed7c4497bb6ab71b701c53e58719ef259b3716751"
      },
      {
        "id": "",
        "name": "8cdcd674a0269945dd4c526b5868efb6df8854a127fd5449e57e89905511391d"
      },
      {
        "id": "",
        "name": "7fb4c9f041d4411311437e12427aaf09d369bc384faa2de4b5bc8ae36a42190e"
      },
      {
        "id": "",
        "name": "7b61ed1049ba5f5b8d9725f32cff1ef1e72ef46e2a1dd87bd2b33e73e7333f44"
      },
      {
        "id": "",
        "name": "78f7b98b1e6f089f5789019dab23ac38f77c662fd651ee212d8451ee61b2fc0c"
      },
      {
        "id": "",
        "name": "75d6f82962f380f7726142490068879240c3c507427f477cf25268b524c30339"
      },
      {
        "id": "",
        "name": "72ece359a3c6f286d174b9cccc7c963577749e38e28f5ecf00dd4c267478a693"
      },
      {
        "id": "",
        "name": "712b81f1a82b9ea9a304220ed87c47c329392c2ce040ed3bff936fe33456acff"
      },
      {
        "id": "",
        "name": "705e5f1245e59566895b1d456aee32d4bff672a6a00f2cd390d7d50c12316dee"
      },
      {
        "id": "",
        "name": "6edf72495e03ca757fa55beb2ea02492f2e7a4b85ca287a9d08bbe60e390c618"
      },
      {
        "id": "",
        "name": "69e2a259e0136b61a3acad3f8fad2c012c75c9d8e26e66a3f0af1e7c23506b5c"
      },
      {
        "id": "",
        "name": "63e813b5bf94bdec9ce35c9d7311f76c3a35728d158ade0a6487fc99c73dcf31"
      },
      {
        "id": "",
        "name": "4f3ec89d5ea0a513afa3f49434f67b7e1540a4a8a93d078def950bd94d444723"
      },
      {
        "id": "",
        "name": "517ef26be8b9fb1af0e9780b244827af4937ad2fa4778a0bd2d9c65502ce54e1"
      },
      {
        "id": "",
        "name": "488201c08219f5cbd79d16702fb909d4e8ad8fa76819a21e0f262e2935e58dd2"
      },
      {
        "id": "",
        "name": "362b0959b639ab720b007110a1032320970dd252aa07fc8825bb48e8fdd14332"
      },
      {
        "id": "",
        "name": "2110b9a4c74d1c8be1aed6ebcff2351cad3d16574026fe4697a9c70810fb1d9e"
      },
      {
        "id": "",
        "name": "1e0a7737a484699d035c0568771c4834c0ff3fb9ba87aded3c86705e10e9bb0e"
      }
    ],
    "intrusion_sets": [
      {
        "id": "7f221749-9f0f-4d3f-8939-d56f3b8e80b8",
        "name": "Earth Kasha",
        "slug": "earth-kasha"
      }
    ],
    "attack_patterns": [
      {
        "id": "e7d42089-23ed-495f-a2bc-c942c4e56fb7",
        "name": "T1573.002"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Japan"
      }
    ]
  },
  "external_refs": [
    "https://documents.trendmicro.com/images/TEx/Earth-Kasha-Blog-IoCshFxTmpo.txt",
    "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html",
    "https://otx.alienvault.com/pulse/6813da43537c3d86e6ba3ca2"
  ]
}