Earth Kurma Targets Southeast Asia With Rootkits and Cloud-Based Data Theft Tools
Since June 2024, a new advanced persistent threat (APT) group known as Earth Kurma has launched a "sophisticated" campaign against the government and telecommunications sectors in Southeast Asia.
According to Trend Micro, the attacks have used rootkits, cloud storage services, and proprietary malware to exfiltrate data. Among the main goals are Malaysia, Thailand, Vietnam, and the Philippines.
In an investigation released last week, security researchers Nick Dai and Sunny Lu stated that this operation presents a significant business risk because of targeted espionage, credential theft, permanent footholds created by kernel-level rootkits, and data exfiltration via reliable cloud platforms.
The threat actor has been active since November 2020, and Dropbox and Microsoft OneDrive ha...