Earth Estries Cyberespionage campaign

Researchers have discovered that a threat actor is quietly stealing information across the globe from various organizations.

The ongoing campaign was dubbed as Earth Estries that existed since at least 2020 and overlaps to some degree with another cyber espionage outfit, FamousSparrow and span the globe from the US to the Philippines, Germany, Taiwan, Malaysia, and South Africa.

Earth Estries has a penchant for using DLL sideloading to run any of its three custom malware — two backdoors and an infostealer — along with other tools like Cobalt Strike.

The group possesses three unique malware tools: Zingdoor, TrillClient, and HemiGate.

Zingdoor is an HTTP backdoor first developed in June 2022, deployed in only limited instances since. It’s written in Golang, affording it cross-platform capabilities and packed with UPX. It can retrieve system and Windows services information; enumerate, upload, or download files; and run arbitrary commands on a host machine.

TrillClient is a combination installer and infostealer, also written in Go, and packaged in a Windows cabinet file. The stealer is designed to collect browser credentials, with an added ability to act or sleep on command or at random intervals, with the goal of avoiding detection. Along with Zingdoor, it sports a custom obfuscator designed to stump analysis tools.

HemiGate is a multi-instanc e tool. It’s an all-in-one malware that includes features for keylogging, capturing screenshots, running commands, and monitoring, adding, deleting, and editing files, directories, and processes.

Earlier this year, researchers observed Earth Estries using compromised accounts with administrative privileges to infect an organization’s internal servers;It planted Cobalt Strike to establish a foothold in the system, then used SMB and WMI command line to bring its own malware to the party.

In its methods, Earth Estries gives the impression of a clean, deliberate operation.

To execute its malware on a host machine, it reliably opts for the tricky method of DLL sideloading. The threat actors regularly cleaned their existing backdoor after finishing each round of operation and redeployed a new piece of malware when they started another round. This is undertaken to reduce the risk of exposure.

DLL sideloading and another tool the group uses — Fastly CDN — are popular with APT41 sub groups like Earth Longzhi. There are overlaps between Earth Estries’ backdoor loader and FamousSparrow’s.

The exact origin of Earth Estries is unclear. It doesn’t help, either, that its C2 infrastructure is spread across five continents, spanning all of the earth’s hemispheres: from Canada to Australia, Finland to Laos, with the highest concentration in the US and India.

This research was documented by researchers from Trend Micro.

Indicators of Compromise

• cd2b703e1b7cfd6c552406f44ec05480209003789ad4fbba4d4cffd4f104b0a0
• 0eaa67fe81cec0a41cd42866df1223cb7d2b5659ab295dffe64fe9c3b76720aa
• e6f9756613345fd01bbcf28eba15d52705ef4d144c275b8cfe868a5d28c24140
• c7023183e815b9aff68d3eba6c2ca105dbe0a9b05cd209908dcee907a64ce80b
• 1a9e0c7c88e7a8b065ec88809187f67d920e7845350d94098645e592ec5534f6
• efb98b8f882ac84332e7dfdc996a081d1c5e6189ad726f8f8afec5d36a20a730
• 8476ad68ce54b458217ab165d66a899d764eae3ad30196f35d2ff20d3f398523
• dff1d282e754f378ef00fb6ebe9944fee6607d9ee24ec3ca643da27f27520ac3
• 42d4eb7f04111631891379c5cce55480d2d9d2ef8feaf1075e1aed0c52df4bb9
• 45b9204ccbad92e4e5fb9e31aab683eb5221eb5f5688b1aae98d9c0f1c920227
• 98e250bc06de38050fdeab9b1e2ef7e4d8c401b33fd5478f3b85197112858f4e
• b1bc10fa25a4fd5ae7948c6523eb975be8d0f52d1572c57a7ef736134b996586
• 49a0349dfa79b211fc2c5753a9b87f8cd2e9a42e55eca6f350f30c60de2866ce
• 71a503b5b6ec8321346bee3f6129af0b8ad490a36092488d085085cdc0fc6b9d
• 28109c650df5481c3997b720bf8ce09e7472d9cdb3f02dd844783fd2b1400c72
• a8dd0ca6151000de33335f48a832d24412de13ce05ea6f279bf4aaaa2e5aaecb
• deaa3143814c6fe9279e8bc0706df22d63ef197af980d8feae9a8468f441efec
• b6481e0edc36a0472ab0ce7d0817f1773c4af9307ae60890a667930558a762ff
• eeb3d2e87d343b2acf6bc8e4e4122d76a9ad200ae52340c61e537a80666705ed
• 4b014891df3348a76750563ae10b70721e028381f3964930d2dd49b9597ffac3
• 2531891691ef674345f098ef18b274091acdf3f2808cca753674599c043ccd7d
• c59e17806e3a58792f07662b4985119252c8221688084d20b599699bfdb272d8
• e1a7e5f27362aaf0d12b58b96a816ef61a2a498def9805297aa81f6f83729230
• ca6713bedbd19c2ad560700b41774825615b0fe80bf61751177ffbc26c77aa30
• cdadad8d7ced1370baa5d1ffe435bed78c2d58ed4cda364b8a7484e3c7cdac98
• 82f3384723b21f9a928029bb3ee116f9adbc4f7ec66d5a856e817c3dc16d149d
• 415e0893ce227464fb29d76e0500c518935d11379d17fb14effaef82e962ff76
• f6223d956df81dcb6135c6ce00ee14d0efede9fb399b56d2ee95b7b0538fe12c