Earth Lamia

MISP
Type:
Unknown
Country:
CN
First seen:
Unknown
Details:

Earth Lamia is a China-nexus APT that targets organizations across multiple sectors, including finance, logistics, and government, primarily in Latin America, the Middle East, and Southeast Asia. The actor exploits web application vulnerabilities, such as CVE-2025-55182, and employs techniques like SQL injection, DLL sideloading, and the deployment of custom backdoors like PULSEPACK and BypassBoss. Earth Lamia conducts reconnaissance, file operations, and credential theft, often utilizing tools like Cobalt Strike and VShell.

References (2)
Aliases (98)
UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454 UNC5454
Metadata
ID: 943
Created: 17/01/2026 16:00
Updated: 07/03/2026 16:00