REF7707

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat China

Primary Aliases: CL-STA-0049 Earth Alux Erudite Mogwai Ink Dragon

Sponsor / State Affiliation People's Republic of China (PRC)

Primary Motivation Cyber-espionage and financial gain (cryptocurrency fraud via fake exchange portals)

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

South American Foreign Ministry Espionage, Russian IT Service Provider Intrusion, European Government Relay Network

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Government (Foreign Ministries) Defense Telecommunications IT Service Providers Academia Cryptocurrency users

🛡️ MITRE ATT&CK® Attack Lifecycle (9 TTPs)

📥 Download Navigator JSON

Persistence & Privilege Escalation 1

T1547 Use of web shells (OutlookDC.aspx, Error.aspx, TimeoutAPI.aspx) for persistence

Lateral Movement & Collection 1

T1021 Lateral movement via Group Policy (GPO) and administrative RDP sessions

Command & Control 4

T1071 Abuse of Microsoft Graph API for C2 to blend with legitimate Outlook traffic

T1071 Deployment of custom malware families including FinalDraft (SquidDoor), NetDraft (NosyDoor), and ShadowPad

T1071 C2 communication via DNS and ICMP tunneling

T1071 Abuse of public cloud infrastructure (Yandex Cloud, OneDrive, Google Drive) for data exfiltration and C2

Operational Techniques 3

T1000 Exploitation of ASP.NET ViewState deserialization and SharePoint ToolShell vulnerabilities

T1000 Use of renamed legitimate system binaries (e.g., cdb.exe renamed to 7zup.exe) to bypass allowlisting

T1000 Participation in a 'shared toolkit' ecosystem among various China-nexus clusters

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Jewelbug UAT-8302 APT: Dual-Mandate Espionage and Cryptocurrency Theft

Attacks and Vulnerabilities 2026-08-13

[DEEP DIVE] Earth Alux UAT-8302 Espionage Campaign: VARGEIT and COBEACON Malware Deployment

Attacks and Vulnerabilities 2026-06-23

Copied to clipboard

LINK COPIED TO CLIPBOARD