VERY IMPORTANT

A threat actor named Earth Krahang has been targeting government entities worldwide since early 2022, focusing on Southeast Asia but also Europe, America, and Africa. The group exploits public-facing servers and sends spear phishing emails to deliver backdoors. Earth Krahang abuses compromised government infrastructure to attack other governments, hosting payloads, proxying traffic, and sending emails. The actor's goal appears to be cyberespionage. Earth Krahang uses the RESHELL and XDealer malware families and post-exploitation tools like Cobalt Strike.