New Threat Group “Earth Longzhi” Targeting Global Government, Infrastructure, Aviation, Health, and Finance Orgs

On November 9, 2022, Trend Micro researchers reported two campaigns they attribute to a new threat group Earth Longzhi, which they assess is a subgroup of APT41.

Context

Trend Micro researchers based the assessed connection between the groups on shared targets, shared Cobalt Strike metadata, code similarities, and shared tactics, techniques, and procedures (TTPs).

Impact Analysis

Trend Micro analysts identified two potential circumstances implied by the similarities between the groups:

• These threat actors are no longer static groups. Although the organizational structure will keep changing from time to time, the tools will be inherited by the subsequent newly organized groups.
• The tool developers and campaign operators share the tools with their collaborator groups.

In addition to these circumstances, it should also be noted that many TTPs and code spread throughout the threat landscape in additional ways, including leaks that are then coopted by other actors and the selling of tools as a service by threat groups or rogue developers.

Technical Details

According to Trend Micro, there were two campaigns:

1. May 2020 – Feb 2021, in which Earth Longzhi targeted government, healthcare, academic, and infrastructure industries in Taiwan with a custom Cobalt Strike loader and custom hacking tools.
2. Aug 2021 – June 2022, in which the group targeted organizations in defense, aviation, development, and finance across multiple geographic regions with multiple customized Cobalt Strike loaders.

IOCs

Trend Micro researchers provided the following IOCs: