Spot the difference: Earth Kasha's new LODEINFO campaign and the correlation analysis with APT10 umbrella

Wednesday 2 October 16:30 - 17:00, Green room

Hiroaki Hara (Trend Micro)

LODEINFO is a piece of malware that has been leveraged in a cyber espionage campaign predominantly targeting entities within Japan since 2019. Trend Micro has been tracking this group, which has exclusively used LODEINFO, as "Earth Kasha". Earth Kasha was previously documented to have conducted spear-phishing email campaigns against public sector organizations and highly selected individuals in Japan. However, in 2023 our analysis identified a new wave of campaigns with drastic updates to their strategy, tactics and arsenal.

In the initial access phase, Earth Kasha has transitioned to exploiting public-facing applications, such as Array AG, FortiGate, Proself and NetScaler. Furthermore, their target selection has expanded beyond Japan to include entities in Taiwan and India, with the focus shifting towards advanced technology firms and government bodies.

The post-exploitation tradecraft has also been refined. During the latest campaign, attempts at information theft designed to exfiltrate sensitive data from a compromised network were observed.

Regarding the malware arsenal, while LODEINFO was observed in most intrusions, we also discovered a previously undocumented backdoor implant dubbed "NOOPDOOR". NOOPDOOR is a sophisticated modular backdoor implementing advanced capabilities, such as evasive persistence mechanisms, daily-changing Domain Generation Algorithm (DGA) for infrastructure resilience, and active/passive backdoor channel supporting. We will introduce in-depth analysis of the notable malware observed in this campaign.

Concerning an attribution, through our comprehensive analysis based on victimology, infrastructures, TTPs and toolsets, we will discuss the similarities and differences between the latest LODEINFO campaign and the previously known campaigns by several groups, including APT10 Umbrella (menuPass and Earth Tengshe), Volt Typhoon, and other unclustered activities. Our research will highlight the recent complex situation and potential relationships among China-nexus threat actors in sharing zero-days, TTPs, infrastructures and toolsets.

Hiroaki Hara Hiroaki Hara is a threat researcher at Trend Micro. He focuses on threat intelligence research in the Asia-Pacific region. He specializes in threat hunting, incident response, reverse engineering, and threat intelligence analysis. He has previously presented in Botconf, HITCON and JSAC.

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers