Earth Baxia
Earth Baxia is classified as other threat group.
- Malware families
- 1
- Origin
- China
Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote code execution, deploying customized Cobalt Strike components with altered signatures, leveraging GrimResource and AppDomainManager injection techniques to deliver additional payloads, and utilizing a new backdoor named EAGLEDOOR for multi-protocol communication and payload delivery.
The group's reported origin is China.
The group is associated with 1 malware families.
The group is associated with 1 malware families.
Malware families
- Cobalt Strike
Published reports on this actor:
- https://www.tgsoft.it/news/news_archivio.asp?id=1568
- https://jp.security.ntt/tech_blog/appdomainmanager-injection
- https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.