Earth Baxia
MISP
Tipo:
Unknown
Unknown
Paese:
CN
CN
Prima attivita:
Unknown
Unknown
Dettagli:
Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote code execution, deploying customized Cobalt Strike components with altered signatures, leveraging GrimResource and AppDomainManager injection techniques to deliver additional payloads, and utilizing a new backdoor named EAGLEDOOR for multi-protocol communication and payload delivery.
Metadata
| ID: | 737 |
| Created: | 13/01/2026 17:48 |
| Updated: | 07/03/2026 16:00 |