@thehellu profile picture
Daniel Lunghi @thehellu

Threat researcher @trendai_RSRCH mostly focused on #APT

Joined February 2011
  • Tweets 247
  • Following 599
  • Followers 2,168
71 Photos and videos
Pinned Tweet
Daniel Lunghi@thehellu
22 Oct 2025
We saw Earth Estries, an advanced #APT group, sharing its access to Earth Naga (Flax Typhoon). We introduce the term "Premier Pass" to describe this behavior, and propose a four-tier classification framework for collaboration types among advanced groups trendmicro.com/en_us/researc…
Image describing the Earth Estries and Earth Naga malware toolkits

ALT Image describing the Earth Estries and Earth Naga malware toolkits

Table with the different victims of Earth Estries and Earth Naga, classified by industry and location

ALT Table with the different victims of Earth Estries and Earth Naga, classified by industry and location

List of collaboration types and the MITRE tactic stage where the sharing occurs

ALT List of collaboration types and the MITRE tactic stage where the sharing occurs

Malware toolkit involved in this report

ALT Malware toolkit involved in this report
2
8
845
We investigated a CN #APT that targeted multiple governments and companies with government contracts in Asia. In half of the targets we found a second group with different malware toolkit but sharing the infection vector and some post-exploitation tools trendmicro.com/en_us/researc…
Countries being targeted by SHADOW-EARTH-053 and SHADOW-EARTH-054

ALT Countries being targeted by SHADOW-EARTH-053 and SHADOW-EARTH-054

Table comparing SHADOW-EARTH-053 and SHADOW-EARTH-054

ALT Table comparing SHADOW-EARTH-053 and SHADOW-EARTH-054

Links from SHADOW-EARTH-054 to other intrusion sets

ALT Links from SHADOW-EARTH-054 to other intrusion sets

Dates of different campaigns by SHADOW-EARTH-053 and SHADOW-EARTH-054

ALT Dates of different campaigns by SHADOW-EARTH-053 and SHADOW-EARTH-054
35
98
9,204
We investigated an #APT with links to Void Rabisu that used Trend Micro updates as a lure in a recent campaign involving vulnerability exploitation. There were at least 4 stages before the final payload, some of them being tailored to the targeted machine trendmicro.com/en_us/researc…
email using Trend Micro updates as a lure

ALT email using Trend Micro updates as a lure

targeted industries

ALT targeted industries

comparison between this intrusion set and Void Rabisu

ALT comparison between this intrusion set and Void Rabisu

Decoy website mimicking Trend Micro design used when vulnerability exploitation fails

ALT Decoy website mimicking Trend Micro design used when vulnerability exploitation fails
4
20
9,291
We released a report on a threat actor using an updated version of #Shadowpad including anti-debugging features, that in some cases deploy a custom ransomware family. We have mainly seen the manufacturing industry being targeted in Europe and Asia trendmicro.com/fr_fr/researc… #APT

Updated Shadowpad Malware Leads to Ransomware Deployment

In this blog entry, we discuss how Shadowpad is being used to deploy a new undetected ransomware family. Attackers deploy the malware by exploiting weak passwords and bypassing multi-factor authent...

trendmicro.com
1
13
40
3,290
For incident responders out there, remember to retrieve the volume serial number where #Shadowpad was deployed, since it is used to encrypt the payload in the registry. Those serial numbers can also be found in LNK and prefetch files in case you don't have live access to the host
1
3
8
623
Orange Cyberdefense saw the same threat and named the ransomware "NailaoLocker". orangecyberdefense.com/globa…. They share interesting thoughts on the motivations of the ransomware deployment, although they don't have the final answer. We also saw no financial gain for the threat actor
2
7
618
Intelligence Online links the Moonshine framework that we discussed in our Earth Minotaur report trendmicro.com/en_us/researc… to a Chinese company. Happy new year UPSEC ! 🥳

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

trendmicro.com
Intelligence Online
@Intel_Online
29 Jan 2025
[Free access] 🇨🇳 Intelligence Online has been able to link an official Chinese public security ministry contractor to recent IT hacking operations carried out against the Uyghurs and Tibetans, two peoples reviled by China. 1/3 ⬇️
12
36
4,641
Daniel Lunghi retweeted
Mandiant (part of Google Cloud)@Mandiant
28 Jan 2025
Ever wonder how attackers use advanced tools to evade detection? Mandiant analyzes #ScatterBrain, an obfuscator in the POISONPLUG.SHADOW backdoor, which is used by China-nexus actors. Learn how we’re unmasking these sophisticated threats. Read more: bit.ly/42xfceL
36
74
7,309
Our latest report presents Earth Minotaur, a threat actor targeting Tibetans and Uyghurs using Moonshine, an exploitation framework for Android described in 2019 by @citizenlab leveraging vulnerabilities in applications embedding old versions of Chrome trendmicro.com/en_us/researc…
Attack chain from Moonshine to DarkNimbus

ALT Attack chain from Moonshine to DarkNimbus

Validation flow by checking user agent

ALT Validation flow by checking user agent

Exploited vulnerabilities

ALT Exploited vulnerabilities

Targeted Android applications

ALT Targeted Android applications
18
30
3,267
Daniel Lunghi retweeted
Jl_N_@Jl_N_
17 Jul 2024
Nous recrutons dans notre équipe. Si vous avez des compétences en RE, souhaitez travailler au profit de la Gendarmerie en tant qu'expert judiciaire et manager une équipe de passionnés : ministereinterieur-career.ta… (rt apprécié)
11
5
1,400
Excellent malware analysis from Checkpoint that describes the Linux version of Xdealer/DinodasRAT that we listed but did not described in our Earth Krahang #APT report research.checkpoint.com/2024… Kudos for referencing all the related reports 👏

Malware Spotlight: Linodas aka DinodasRAT for Linux - Check Point Research

Introduction In recent months, Check Point Research (CPR) has been closely monitoring the activity of a Chinese-nexus cyber espionage threat actor who is focusing on Southeast Asia, Africa, and South...

research.checkpoint.com
7
32
2,619
Daniel Lunghi retweeted
Mark Kelly@markkelly0x
20 Mar 2024
It’s been a minute since the last i-SOON blog 🇨🇳@RecordedFuture is releasing further research exploring infrastructure, tooling, victimology, and personnel overlap between I-SOON & multiple Chinese state-sponsored groups: RedAlpha, RedHotel, & POISON CARP recordedfuture.com/attributi…

1
32
80
9,322
Our latest report on a CN #APT targeting tens of governments entities worldwide has been published 🥳 After monitoring it for a long time we realized it is likely related to the recent I-Soon company leaks. It discusses their TTPs and provides lots of IOCs trendmicro.com/en_us/researc…
Earth Krahang infection vector

ALT Earth Krahang infection vector

Python script used to exfiltrate victim's mailbox

ALT Python script used to exfiltrate victim's mailbox

Map of targets and victims

ALT Map of targets and victims

Likely attribution of Earth Krahang to the I-Soon company

ALT Likely attribution of Earth Krahang to the I-Soon company

1
46
110
14,552
Targets are spread among 5 continents, although some countries are targeted more heavily: one country had 11 of its government entities compromised. Previous victims are used to compromise new ones by abusing their infrastructure to send spear-phishing emails or host malware
Map of targets and victims from Earth Krahang

ALT Map of targets and victims from Earth Krahang

1
1
731
Their favorite malware toolkit are Reshell, a basic .NET backdoor, and Xdealer, also named Dinodas RAT, two custom malwares. They also use the infamous #CobaltStrike, #PlugX and #Shadowpad. Many of their offensive and post-exploitation tools are retrieved from public sources.
Description of the favorite offensive tools from Earth Krahang

ALT Description of the favorite offensive tools from Earth Krahang

List of post exploitation TTPs

ALT List of post exploitation TTPs
1
1
733
VB released my talk on a #Shadowpad sample delivered by a Pakistan gov application. It contains an analysis of the modified MSI installer, some tricks to pivot on old and new Shadowpad samples, an overview of the #APT campaign, and attribution discussion youtube.com/watch?v=i52MH-YF…

2
22
54
7,758
The slides virusbulletin.com/uploads/pd… and paper virusbulletin.com/uploads/pd… are also available. In addition to what we published in July in our blog, the paper details our failed attempts to attribute this attack based on custom malware families and their links to other #APT groups
Schematics describing the new encryption algorithm used by Shadowpad, using AES-CBC 128-bits encryption key

ALT Schematics describing the new encryption algorithm used by Shadowpad, using AES-CBC 128-bits encryption key

We noticed multiple samples share the same base encryption key, which might indicate that different threat actors use different base encryption keys.

ALT We noticed multiple samples share the same base encryption key, which might indicate that different threat actors use different base encryption keys.

Differences between a legitimate and a malicious connection to a local IP address used by the compromised application, and by Shadowpad as C&C

ALT Differences between a legitimate and a malicious connection to a local IP address used by the compromised application, and by Shadowpad as C&C

Multiple custom malware families found at one of the victims

ALT Multiple custom malware families found at one of the victims

1
2
9
1,003
We found a probable supply chain attack on eOffice application developed by Pakistan government. It delivers #Shadowpad with an updated obfuscation and encryption scheme. The threat actor carefully chose the C&C to blend in legitimate network traffic trendmicro.com/en_us/researc… #APT
eOffice installer prompt

ALT eOffice installer prompt

List of campaign targets

ALT List of campaign targets

Shadowpad configuration structure

ALT Shadowpad configuration structure

Network trick to blend in legitimate traffic

ALT Network trick to blend in legitimate traffic

3
49
99
46,633
The blogpost is live again with an update to reflect the possibility that the MSI installer could have been modified and then redistributed. However, as it was not publicly available, that would imply that the threat actor retrieved it from a PK gov entity before weaponizing it
1
3
9
933
Daniel Lunghi retweeted
Paul Rascagnères@r00tbsd
12 Jul 2023
If you missed it yesterday, Microsoft released an advisory concerning the CVE-2023-36884: msrc.microsoft.com/update-gu…. This RCE is currently used by a TA and there is no patch. You should apply the mitigation described in the advisory. 1/4
4
170
369
81,348
Load more