{
  "name": "Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions",
  "slug": "game-of-emperor-unveiling-long-term-earth-estries-cyber-intrusions",
  "description": "Earth Estries, a Chinese APT group, has been aggressively targeting critical sectors globally since 2023. The group employs advanced techniques and multiple backdoors, including GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, to compromise organizations in telecommunications, government, and other industries across various countries. Their sophisticated attacks exploit server vulnerabilities for initial access and use living-off-the-land binaries for lateral movement. Earth Estries has successfully infiltrated over 20 organizations, demonstrating a complex C&C infrastructure and possible shared tools with other Chinese APT groups. The group's operations involve long-term espionage activities, targeting not only critical services but also vendor networks to facilitate broader access.",
  "published": "2024-12-03T14:34:04+00:00",
  "created_at": "2024-12-03T14:34:04+00:00",
  "modified_at": "2024-12-03T15:24:33+00:00",
  "created_at_opencti": "2024-12-03T14:34:04+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-12-03",
    "chinese apt",
    "crowdoor",
    "demodex",
    "government",
    "masol rat",
    "snappybee",
    "sparrowdoor",
    "telecommunications"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "96.9.211.27"
      },
      {
        "id": "",
        "name": "91.245.253.27"
      },
      {
        "id": "",
        "name": "45.125.67.144"
      },
      {
        "id": "",
        "name": "43.226.126.165"
      },
      {
        "id": "",
        "name": "43.226.126.164"
      },
      {
        "id": "",
        "name": "205.189.160.3"
      },
      {
        "id": "",
        "name": "185.105.1.243"
      },
      {
        "id": "",
        "name": "172.93.165.14"
      },
      {
        "id": "",
        "name": "172.93.165.10"
      },
      {
        "id": "",
        "name": "146.70.79.18"
      },
      {
        "id": "",
        "name": "146.70.79.105"
      },
      {
        "id": "",
        "name": "143.198.92.175"
      },
      {
        "id": "",
        "name": "139.59.236.31"
      },
      {
        "id": "",
        "name": "104.194.153.65"
      },
      {
        "id": "",
        "name": "103.75.190.73"
      },
      {
        "id": "",
        "name": "139.99.114.108"
      },
      {
        "id": "",
        "name": "139.59.108.43"
      },
      {
        "id": "",
        "name": "27.102.113.240"
      },
      {
        "id": "",
        "name": "23.81.41.166"
      },
      {
        "id": "",
        "name": "165.154.227.192"
      },
      {
        "id": "",
        "name": "103.159.133.251"
      },
      {
        "id": "",
        "name": "103.159.133.205"
      },
      {
        "id": "",
        "name": "141.255.164.98"
      },
      {
        "id": "",
        "name": "103.91.64.214"
      },
      {
        "id": "",
        "name": "158.247.222.165"
      },
      {
        "id": "",
        "name": "193.239.86.168"
      },
      {
        "id": "",
        "name": "www.infraredsen.com"
      },
      {
        "id": "",
        "name": "http://141.255.164.98:2096"
      },
      {
        "id": "",
        "name": "http://103.159.133.205/lib3.cab"
      },
      {
        "id": "",
        "name": "vpn943823465.softether.net"
      },
      {
        "id": "",
        "name": "vpn487875652.softether.net"
      },
      {
        "id": "",
        "name": "vpn305783366.softether.net"
      },
      {
        "id": "",
        "name": "private.royalnas.com"
      },
      {
        "id": "",
        "name": "news.colourtinctem.com"
      },
      {
        "id": "",
        "name": "jasmine.lhousewares.com"
      },
      {
        "id": "",
        "name": "helpdesk.stnekpro.com"
      },
      {
        "id": "",
        "name": "billing.clothworls.com"
      },
      {
        "id": "",
        "name": "materialplies.com"
      },
      {
        "id": "",
        "name": "vpn114240349.softether.net"
      },
      {
        "id": "",
        "name": "esh.hoovernamosong.com"
      },
      {
        "id": "",
        "name": "api.solveblemten.com"
      },
      {
        "id": "",
        "name": "pulseathermakf.com"
      },
      {
        "id": "",
        "name": "palloaltonetworks.com"
      },
      {
        "id": "",
        "name": "imap.dateupdata.com"
      },
      {
        "id": "",
        "name": "fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5"
      },
      {
        "id": "",
        "name": "fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098"
      },
      {
        "id": "",
        "name": "b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac"
      },
      {
        "id": "",
        "name": "9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c"
      },
      {
        "id": "",
        "name": "2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec"
      },
      {
        "id": "",
        "name": "1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296"
      },
      {
        "id": "",
        "name": "16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266"
      },
      {
        "id": "",
        "name": "05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870"
      },
      {
        "id": "",
        "name": "b63c82fc37f0e9c586d07b96d70ff802d4b707ffb2d59146cf7d7bb922c52e7e"
      },
      {
        "id": "",
        "name": "6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc"
      },
      {
        "id": "",
        "name": "44ea2e85ea6cffba66f5928768c1ee401f3a6d6cd2a04e0d681d695f93cc5a1f"
      },
      {
        "id": "",
        "name": "2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31"
      },
      {
        "id": "",
        "name": "25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b"
      }
    ],
    "malware": [
      {
        "id": "de8f3c26-bfaf-48cf-8e7f-c30add3e6eb9",
        "name": "SparrowDoor",
        "slug": "sparrowdoor"
      },
      {
        "id": "fd8b2c46-b03b-4297-8230-dbb901fa4cd7",
        "name": "MASOL RAT",
        "slug": "masol-rat"
      },
      {
        "id": "45b975d8-53db-4d6c-9bf2-306d2477ada4",
        "name": "SNAPPYBEE",
        "slug": "snappybee"
      },
      {
        "id": "07d58e2e-a58c-4129-ac9c-52742fb2fce9",
        "name": "GHOSTSPIDER",
        "slug": "ghostspider"
      },
      {
        "id": "55b95ab2-967f-4ad6-92b1-d862f9238c27",
        "name": "CrowDoor",
        "slug": "crowdoor"
      },
      {
        "id": "33c17279-4354-4288-b863-f8c04612ef8e",
        "name": "DEMODEX",
        "slug": "demodex"
      }
    ],
    "intrusion_sets": [
      {
        "id": "500a0686-f20b-4b46-846b-38af11e03f33",
        "name": "Earth Estries",
        "slug": "earth-estries"
      }
    ],
    "attack_patterns": [
      {
        "id": "5d2af906-6187-4702-ab9f-590fbe5b1ca3",
        "name": "T1021.002"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "de38dd3a-41d7-4621-8a00-a32d7f0ff420",
        "name": "T1102.002"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "e7d42089-23ed-495f-a2bc-c942c4e56fb7",
        "name": "T1573.002"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2021-26858"
      },
      {
        "id": "",
        "name": "CVE-2021-26857"
      },
      {
        "id": "",
        "name": "CVE-2021-27065"
      },
      {
        "id": "",
        "name": "CVE-2022-3236"
      },
      {
        "id": "",
        "name": "CVE-2023-48788"
      },
      {
        "id": "",
        "name": "CVE-2024-21887"
      },
      {
        "id": "",
        "name": "CVE-2023-46805"
      },
      {
        "id": "",
        "name": "CVE-2021-26855"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Eswatini"
      },
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "South Africa"
      },
      {
        "id": "",
        "name": "Afghanistan"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Thailand"
      },
      {
        "id": "",
        "name": "Malaysia"
      },
      {
        "id": "",
        "name": "Indonesia"
      },
      {
        "id": "",
        "name": "Philippines"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "Consulting"
      },
      {
        "id": "",
        "name": "Chemical"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/k/earth-estries/IOC_list-EarthEstries.txt",
    "https://www.trendmicro.com/en_us/research/24/k/earth-estries.html",
    "https://otx.alienvault.com/pulse/674f24ec65cfa513e8c9799f"
  ]
}