From 8108d2b1fec4af863e42e34760b1441074e97542 Mon Sep 17 00:00:00 2001
From: Rony <49360849+r0ny123@users.noreply.github.com>
Date: Tue, 24 Sep 2024 05:06:44 +0000
Subject: [PATCH] chg: [threat-actor] add earth baxia

---
 clusters/threat-actor.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5dfa613..76e932d 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -16688,6 +16688,20 @@
       },
       "uuid": "071d271a-313f-442d-9bf0-10e6eeba0a8e",
       "value": "HikkI-Chan"
+    },
+    {
+      "description": "Earth Baxia is a threat actor opearting ot of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote code execution, deploying customized Cobalt Strike components with altered signatures, leveraging GrimResource and AppDomainManager injection techniques to deliver additional payloads, and utilizing a new backdoor named EAGLEDOOR for multi-protocol communication and payload delivery.",
+      "meta": {
+        "country": "CN",
+        "refs": [
+          "https://www.tgsoft.it/news/news_archivio.asp?id=1568",
+          "https://jp.security.ntt/tech_blog/appdomainmanager-injection",
+          "https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html",
+          "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt"
+        ]
+      },
+      "uuid": "d0c2cd99-64d5-406f-abd7-16b9e27966a7",
+      "value": "Earth Baxia"
     }
   ],
   "version": 313