Earth Krahang
Earth Krahang is a China-linked cyber espionage intrusion set monitored since early 2022 that has targeted government entities worldwide, with a strong operational focus on Southeast Asia and additional victims in Europe, the Americas, and Africa. Reporting cited in the content states the actor targeted 116 entities across 35 countries, with approximately 70 confirmed victims in 23 countries, and primarily focused on government ministries, especially foreign affairs organizations; later reporting also links a campaign named PONDSNAKE, targeting government organizations and financial institutions including insurance and securities firms, to Earth Krahang with medium-to-high confidence. Observed initial access methods include spear-phishing and exploitation of public-facing servers, including repeated abuse of Openfire CVE-2023-32315 and Oracle Web Applications Desktop Integrator CVE-2022-21587. The actor has used compromised government web servers and government email accounts to host payloads, proxy attack traffic, and send spear-phishing emails to other government entities, leveraging intergovernmental trust. Reported lures included geopolitical and government-themed subjects. Earth Krahang also harvested large numbers of email addresses, brute-forced Exchange and other mail services to obtain credentials, and exfiltrated victim email, including via Outlook on the web, ActiveSync, and Zimbra APIs. The group’s tooling includes PlugX, ShadowPad, ReShell/RESHELL, XDealer/DinodasRAT, Cobalt Strike, SnakeC2, NEOBEACON, VShell, and SoftEther VPN. RESHELL is described as a .NET backdoor packed with ConfuserEX that supports information collection, file dropping, command execution, and AES-encrypted C2. Since 2023, the actor reportedly shifted from RESHELL to XDealer/DinodasRAT and used both Windows and Linux variants. In PONDSNAKE, operators deployed SnakeC2 variants, NEOBEACON using OneDrive and Microsoft Graph API for C2, Cobalt Strike, VShell, and SoftEther VPN. Additional observed tradecraft includes DLL side-loading, scheduled-task persistence, enabling RDP via registry changes, credential dumping with Mimikatz or ProcDump, SAM access, network scanning with Fscan, lateral execution with WMIC, and use of privilege-escalation tools and exploits including BadPotato, SweetPotato, GodPotato, PrinterNotifyPotato, CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195. The actor also used RedGuard to protect Cobalt Strike infrastructure and renamed SoftEther components to masquerade as legitimate files. The content states Earth Krahang has strong overlaps with Earth Lusca (also known as RedHotel), and Trend Micro assessed Earth Krahang and Earth Lusca are likely managed by the same threat actor and connected to the Chinese government contractor I-Soon. JSAC2026 reporting likewise described Earth Lusca and Earth Krahang activity as reportedly linked to i-Soon. Attribution to China is directly stated in the content; the primary assessed objective is cyber espionage.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Academia & Research
- Telecommunication Services
- Financial Services
- Insurance
- Non-Governmental Organizations
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems. Exploiting CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195 for privilege escalation on Linux systems
Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems. Exploiting CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195 for privilege escalation on Linux systems
Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems. Exploiting CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195 for privilege escalation on Linux systems
The threat actor abused the following vulnerabilities multiple times: CVE-2022-21587: command execution on Oracle Web Applications Desktop Integrator
The threat actor abused the following vulnerabilities multiple times: CVE-2023-32315: command execution on OpenFire
Observables
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage activity cluster reportedly linked to i-Soon; attributed (medium-to-high confidence) to the PONDSNAKE campaign targeting government and financial institutions, using exploitation/spear-phishing for initial access and deploying multiple C2 and remote admin tools.
Uses attack-oriented proxies such as SoftEther for persistent access and covert operations.
Chinese espionage-focused threat actor with a strong Southeast Asia focus, targeting a wide range of entities globally via spear-phishing and exploitation of public-facing servers to deploy multiple malware families and steal sensitive data.
Cyberespionage-focused intrusion set targeting government entities worldwide, especially in Southeast Asia, using exploitation of public-facing servers, spear-phishing, compromised government infrastructure, email credential brute forcing, and mailbox exfiltration.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.