{"id":16973,"date":"2025-04-28T10:32:09","date_gmt":"2025-04-28T10:32:09","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/earth-kurma-southeast-asia-targeted\/"},"modified":"2025-04-28T10:32:10","modified_gmt":"2025-04-28T10:32:10","slug":"earth-kurma-southeast-asia-targeted","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/earth-kurma-southeast-asia-targeted\/","title":{"rendered":"Earth Kurma: Southeast Asia Targeted"},"content":{"rendered":"\n<\/p>\n
\n
\n<\/p>\n

<\/a>\n<\/div>\n

A new advanced persistent threat (APT) group, known as Earth Kurma<\/strong>, has been targeting government and telecommunications sectors in Southeast Asia since June 2024, in a “sophisticated” campaign. The attacks have utilized custom malware, rootkits, and cloud storage services to exfiltrate data, with the Philippines, Vietnam, Thailand, and Malaysia being among the primary targets.<\/p>\n

According to Trend Micro, “this campaign poses a high business risk due to targeted espionage, credential theft, persistent foothold established through kernel-level rootkits, and data exfiltration via trusted cloud platforms,” as stated by security researchers Nick Dai and Sunny Lu in an analysis published last week.<\/p>\n

The threat actor’s activities can be traced back to November 2020, with the intrusions mainly relying on services like Dropbox and Microsoft OneDrive to siphon sensitive data using tools like TESDAT and SIMPOBOXSPY.<\/p>\n

Two other notable malware families in its arsenal include rootkits such as KRNRAT and Moriya<\/a>, the latter of which has been observed previously in attacks aimed at high-profile organizations in Asia and Africa as part of an espionage campaign dubbed TunnelSnake.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Trend Micro also noted that SIMPOBOXSPY and the exfiltration script used in the attacks share similarities with another APT group codenamed ToddyCat<\/a>. However, a definitive attribution remains inconclusive.<\/p>\n

The initial foothold is then abused to scan and conduct lateral movement using a variety of tools like NBTSCAN, Ladon, FRPC, WMIHACKER, and ICMPinger. Additionally, a keylogger referred to as KMLOG is deployed to harvest credentials. It’s currently not known how the threat actors gain initial access to target environments.<\/p>\n

Notably, the use of the open-source Ladon<\/a> framework has been previously attributed<\/a> to a China-linked hacking group called TA428 (aka Vicious Panda).<\/p>\n

Persistence on the hosts is accomplished by three different loader strains referred to as DUNLOADER, TESDAT, and DMLOADER, which are capable of loading next-stage payloads into memory and executing them. These consist of Cobalt Strike Beacons, rootkits like KRNRAT and Moriya, as well as data exfiltration malware.<\/p>\n

\n
\n\"\"
\n<\/a>\n<\/div>\n

What distinguishes these attacks is the use of living-off-the-land (LotL) techniques to install the rootkits, where hackers employ legitimate system tools and features, in this case, syssetup.dll, rather than introducing easily detectable malware.<\/p>\n

While Moriya is engineered to inspect incoming TCP packets for a malicious payload and inject shellcode into a newly spawned “svchost.exe” process, KRNRAT is an amalgamation of five different open-source projects with capabilities such as process manipulation, file hiding, shellcode execution, traffic concealment, and command-and-control (C2) communication.<\/p>\n

KRNRAT, like Moriya, is also designed to load a user-mode agent the rootkit and inject it into “svchost.exe.” The user-mode agent serves as a backdoor to retrieve a follow-on payload from the C2 server.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

“Before exfiltrating the files, several commands executed by the loader TESDAT collected specific document files with the following extensions: .pdf, .doc, .docx, .xls, .xlsx, .ppt, and .pptx,” the researchers said. “The documents are first placed into a newly created folder named “tmp,” which is then archived using WinRAR with a specific password.”<\/p>\n

One of the bespoke tools used for data exfiltration is SIMPOBOXSPY, which can upload the RAR archive to Dropbox with a specific access token. According to a Kasperksy report from October 2023, the generic DropBox uploader<\/a> is “probably not exclusively used by ToddyCat.”<\/p>\n

ODRIZ, another program used for the same purpose, uploads the collected information to OneDrive by specifying the OneDrive refresh token as an input parameter.<\/p>\n

Earth Kurma remains highly active, continuing to target countries around Southeast Asia, with the capability to adapt to victim environments and maintain a stealthy presence. “They can also reuse the same code base from previously identified campaigns to customize their toolsets, sometimes even utilizing the victim’s infrastructure to achieve their goals,” Trend Micro said.<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n