Earth Baxia

MISP
Type:
Unknown
Country:
CN
First seen:
Unknown
Details:

Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote code execution, deploying customized Cobalt Strike components with altered signatures, leveraging GrimResource and AppDomainManager injection techniques to deliver additional payloads, and utilizing a new backdoor named EAGLEDOOR for multi-protocol communication and payload delivery.

Metadata
ID: 737
Created: 13/01/2026 17:48
Updated: 07/03/2026 16:00