Thursday, May 22, 2025
HomeCyber AttackEarth Baku APT Hackers Group Upgraded Its Hacking Toolset for New...

Earth Baku APT Hackers Group Upgraded Its Hacking Toolset for New Cyberespionage

Published on

SIEM as a Service

Follow Us on Google News

The cybersecurity researchers of Trend Micro have recently detected a campaign that has been initiated by the APT threat actor group Earth Baku. According to the security experts, this group has been targetting organizations in the Indo-Pacific region.

Soon after detecting this campaign, the security analysts have conducted a strong investigation to know about the threat actor team and their operation, however, it also has been cleared that the threat actor is initiating attacks since July 2020.

Victim Profile

Since this malicious campaign is targetting the organizations in the Indo-Pacific region, so, it has been cleared that the APT threat actor team Earth Baku has targetted the entities in the following sector:-

- Advertisement - Google News
  • Airline
  • Computer hardware
  • Automotive
  • Infrastructure
  • Publishing
  • Media
  • IT industries 

After investigating the attack, the cybersecurity researchers came to know that all the victims are specifically registered from the following countries:-

  • India
  • Indonesia
  • Malaysia
  • The Philippines
  • Taiwan
  • Vietnam

New tools

Earth Baku applies the earlier unidentified parts of malware in this specific campaign, that’s why the tools have been modified in this campaign that is mentioned below:-

The loaders: StealthVector and StealthMutant

The payloads: ScrambleCross and Cobalt Strike beacon

Attack vectors

In this particular campaign, the APT threat actors of Earth Baku has used several methods so that they can easily enter into the system and then effortlessly implement their operations.

However, we have mentioned all the different means that were being used by the threat actors to enter and infect a target system:-

  • Injection of an SQL script into the system’s Microsoft SQL Server for uploading a malicious file.
  • The exploitation of the Microsoft Exchange Server ProxyLogon vulnerability CVE-2021-26855 for uploading a malicious web shell.
  • Potential distribution via emails carrying malicious attachments.
  • Use of the installer application InstallUtil.exe in a scheduled task.

Attribution

This campaign is linked with one of the earlier campaigns that have been conducted by the Earth Baku, and that campaign was performing all its planned tasks under the alias APT41.

That’s why the experts have attributed the new campaign with the old campaign to find the similarities, and here we have mentioned them below:-

  • Initially, both the campaigns use the installer script named install.bat.
  • Another one is that the shellcode loaders of both campaigns have the identical dynamic link library (DLL), Storesyncsvc.dll, and relevant methods for loading APIs.
  • Both the campaigns payloads implement comparable methods for signature checking as well as decoding their central functions.

Moreover, there are many findings that are yet to know, that’s why the researchers are trying their best to know all the details regarding this attack.

Follow us on Linkedin, Twitter, Facebook for daily Cybersecurity News & Updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party...

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs...

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate...

PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram

A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party...

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs...

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate...