Earth Kurma — APT Profile

Earth Kurma is an APT group targeting government and telecommunications sectors in Southeast Asia, with a primary focus on data exfiltration. They employ advanced custom malware, including rootkits like KRNRAT and MORIYA, and utilize cloud storage services for exfiltration. Their toolsets include TESDAT and SIMPOBOXSPY, and they demonstrate adaptive TTPs and complex evasion techniques. Attribution overlaps with other APT groups, but distinct attack patterns warrant their separate designation.

Tools & malware

Cobalt Strike Framework
DMLOADER Loader
DUNLOADER Loader
FRPC Tool
ICMPinger Tool
KMLOG Stealer
KRNRAT Backdoor
LADON Framework
MORIYA Backdoor
NBTSCAN Tool
ODRIZ Tool
SIMPOBOXSPY Tool
TESDAT Loader
WMIHACKER Tool

Vendor research

Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors Trend Micro
Earth Kurma Targets Southeast Asia With Rootkits and Cloud-Based Data Theft Tools The Hacker News
Earth Kurma APT is actively targeting government and telecommunications orgs in Southeast Asia Security Affairs
Earth Kurma APT targets Southeast Asian government, telecom sectors in latest cyberespionage campaigns Industrial Cyber

Countries linked to this actor

Malaysia targets
Thailand targets

Read the full analysis on IntelFusions