Read more: malware.news
The Earth Baxia APT group, believed to have ties to China, has been engaged in a targeted campaign against government entities and critical infrastructure in the Asia-Pacific (APAC) region. They have been exploiting a critical vulnerability in GeoServer, a popular open-source geospatial web server, to gain initial access. Once inside, attackers deploy custom Cobalt Strike payloads, including a new backdoor named EAGLEDOOR. This campaign raises concerns about the potential for disruption of essential services and demonstrates the growing sophistication of APAC-focused threat actors.