{"id":58585,"date":"2025-04-30T00:00:00","date_gmt":"2025-04-30T00:00:00","guid":{"rendered":"urn:uuid:d0e9f9af-0b4a-d72d-d032-981713a7722e"},"modified":"2025-04-30T00:00:00","modified_gmt":"2025-04-30T00:00:00","slug":"earth-kasha-updates-ttps-in-latest-campaign-targeting-taiwan-and-japan","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/earth-kasha-updates-ttps-in-latest-campaign-targeting-taiwan-and-japan\/","title":{"rendered":"Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Conclusion and security recommendations<\/span><\/h2>\n

Earth Kasha continues to be an active advanced persistent threat and is now targeting government agencies and public institutions in Taiwan and Japan in its latest campaign which we detected in March 2025. Malicious actors behind the group continue to use spear-phishing to target their victims but employ slightly modified TTPs from their previous campaigns. A malicious Excel file now carries ROAMINGMOUSE, when before they used a Word file; additionally, the malicious routine trigger was also switched from a mousemove event to the click event.<\/p>\n

The ANEL file we observed in this new campaign encrypts its version number like the ANEL file version from Earth Kasha\u2019s previous campaign in 2024, but we found that the ANEL file from the 2025 campaign implemented a new command to support an execution of BOF (Beacon Object File) in memory. This latest campaign also potentially leveraged SharpHide for persistence: to launch the second stage backdoor NOOPDOOR through the Hidden Start (hstart64.exe), and to hide a UI of MSBuild on autorun.<\/p>\n

Enterprises and organizations, especially those with high-value assets like sensitive data relating to governance, as well as intellectual property, infrastructure data, and access credentials should continue to be vigilant and implement proactive security measures to prevent falling victim to cyberattacks. We recommend the following measures so enterprises can help secure against the TTPs discussed in this blog:<\/p>\n