Earth Krahang

THREAT ACTOR PROFILE

Earth Krahang

Earth Krahang is a China-nexus espionage group active since early 2022 that specializes in cross-government attacks. It compromises one government entity and then abuses the trust between agencies and countries to reach new victims, hitting roughly 70 organizations across 23 countries, including dozens of government bodies, with spearphishing and exploitation of public-facing servers.

China

Government / Diplomatic

First seen

2022

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Earth Krahang and its China-nexus ties

Earth Krahang is tracked mainly under its Trend Micro name, with overlaps into other China-nexus clusters. It maps to one entry among the government-targeting APTs we track, and its Trend-named, China-nexus profile sits near crews like Earth Lusca.

GROUP PROFILE

Weaponizing trust between governments

Earth Krahang runs cyber espionage against government entities worldwide. Its defining tactic is strategic exploitation of intergovernmental trust: it uses compromised government infrastructure and email accounts to phish and attack other agencies and allied countries.

Our record places its origin as China and ties it to espionage against government and diplomatic targets, with a focus on Southeast Asia. Trend Micro documented around 70 compromised organizations across 23 countries, including 48 government entities.

The group combines spearphishing with exploitation of public-facing servers, deploying the cross-platform DinodasRAT (also tracked as XDealer) and leveraging compromised infrastructure to host malware and relay attacks.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Server exploitation and trusted-government phishing

The stages below come from Earth Krahang activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

DinodasRAT and public-facing exploitation

Initial Access

CVES EXPLOITED

N-day flaws in public-facing and Linux systems

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

Earth Krahang

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Earth Krahang

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Earth Krahang

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Cross-government attacks and DinodasRAT

Reporting tracks the group's trust-abusing campaigns and tooling.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.