The worldwide supply chain is a complex web of interconnected networks, supported by a range of [global supply chain services](https://www.productandbrands.com/supply-chain-services) that keep goods flowing across borders. At present, however, its vulnerabilities are more evident than ever before. Events like geopolitical tensions, climate-induced disasters, pandemics, and cyberattacks have shown how fragile these systems can be. Even a single disruption in one region can cascade across the world, halting production, delaying deliveries, and eroding customer trust. Needless to say, stakes couldn’t be higher for businesses that are dependent on this intricate network.

Given these conditions, a proactive approach to managing supply chain risks is a necessity these days. Businesses that anticipate challenges and plan ahead can safeguard their operations and protect their professional reputations. Those that act decisively and intelligently might even gain a competitive edge in volatile markets. Ultimately, adopting a strategic mindset toward supply chain resilience benefits all, from small enterprises to multinational corporations.

This article outlines actionable steps to help businesses mitigate risks in their supply chains. These strategies aim to help firms of all kinds reduce vulnerabilities, enhance flexibility, and maintain continuity in the face of unforeseen challenges.

### Diversify the Suppliers You Work With

The consequences of putting all your eggs in one basket become painfully clear during supply chain disruptions. A factory shutdown, a border closure, or a political conflict can leave businesses scrambling for alternatives if they rely solely on a single supplier. Sourcing materials from multiple suppliers across diverse regions is a smart way for businesses to reduce their dependence on any one source and distribute risks more evenly.

It’s also possible to diversify by onboarding backup suppliers. It could also involve nearshoring options, or engaging with suppliers in nearby countries or continents that are closer to your business’s home operations. While this process can introduce higher upfront costs or logistical complexities, the long-term resilience it provides far outweighs these challenges.

### Treat Your Suppliers Like Real Business Partners

Strong supply chain relationships are built on trust and collaboration, not transactional exchanges. When businesses and suppliers operate as partners, they are more likely to communicate openly and work together to resolve challenges. This dynamic fosters innovation and strengthens problem-solving capabilities for both organizations. It also ensures both parties’ interests align, which is critical for long-term business partnerships.

Simple actions, like scheduling regular check-ins, sharing risk assessments, or collaborating on contingency planning, can build trust between partner businesses. Organizations that treat suppliers as extensions of the business will benefit from smoother operations and find their partners more willing to support them during crises.

### Invest in Supply Chain Visibility

Blind spots in a supply chain can quickly lead to costly surprises. To prevent this, businesses should prioritize real-time visibility over their operations. Today, there are many technologies that can be leveraged for insight into potential bottlenecks or risks. Prominent examples of such cutting-edge solutions include IoT-enabled tracking systems, blockchain for secure data sharing, and AI-powered analytics.

Supply chain visibility enables businesses to monitor the movement of goods, anticipate delays, and identify disruptions before they escalate. Beyond managing risks, it also enhances efficiency and customer satisfaction by providing accurate updates and faster resolutions.

### Develop Contingency Plans

When a disruption occurs, businesses without a plan often scramble to react—and lose precious time and resources in the process. A robust contingency plan is a necessary roadmap for navigating the unexpected, no matter the nature of the threat. These plans should outline key response protocols, alternative supply routes, and clear communication channels for stakeholders.

The most effective contingency plans are tailored to specific scenarios and are updated regularly to reflect new risks or changes in the supply chain. It also helps to rehearse these plans through simulations or drills. Doing so will allow response-ready teams to act faster and more decisively during real crises without the problem of decision-making paralysis.

### Monitor Geopolitical and Economic Trends

The global landscape is constantly shifting, and political tensions, trade policies, and economic fluctuations all play significant roles in supply chain stability. For example, trade restrictions or sanctions can create sudden barriers, while economic downturns may affect supplier viability.

It’s thus in the best interest of any business to stay informed about such trends and anticipate potential disruptions. Subscribing to industry reports can provide valuable insights, alongside attending trade forums or leveraging AI-driven risk intelligence tools. Proactive monitoring allows businesses to adapt sourcing strategies or logistics plans ahead of emerging challenges.

### Emphasize Sustainability and Compliance

Sustainability and regulatory compliance aren’t just ethical imperatives; they are critical for reducing long-term risks. Supply chains that prioritize eco-friendly practices and adhere to regulations are less likely to face reputational damage or penalties. 
Moreover, sustainable practices such as using renewable resources or optimizing transportation routes often lead to cost savings and increased operational efficiency. An organization that partners with suppliers who share its environmental and compliance commitments will find its chain further strengthened against any potential disruptions.

### Conduct Regular Risk Assessments

A resilient supply chain is one that continually evaluates its vulnerabilities. Regular risk assessments help businesses identify weak links, such as financially unstable suppliers or outdated technology. These assessments should involve both internal reviews and collaboration with external partners. Risk assessment tools, including supplier scorecards and predictive analytics, can provide actionable insights. By conducting these evaluations at scheduled intervals, businesses can stay ahead of potential threats and maintain the integrity of their supply chain.
A resilient supply chain requires foresight to build, as well as adaptability and a commitment to proactive risk management. Implementing thoughtful strategies today can empower businesses to navigate uncertainty with confidence and turn potential vulnerabilities into opportunities for growth.


The worldwide supply chain is a complex web of interconnected networks, supported by a range of global supply chain services that keep goods flowing across borders. 

How to Mitigate Risks in Global Supply Chains

## A Comprehensive Approach to Digital Security

The Securities and Exchange Board of India (SEBI) has introduced the Cybersecurity and Cyber Resilience Framework (CSCRF) to bolster the cybersecurity posture of market intermediaries. This comprehensive framework addresses a wide range of security concerns, including application security (AppSec), to safeguard sensitive financial data and ensure operational resilience.

### Key Components of SEBI’s CSCRF

The CSCRF mandates a holistic approach to cybersecurity, encompassing the following key components:

1. **Risk Assessment and Management:**
    - Conduct regular risk assessments to identify and prioritize potential threats.
    - Develop and implement effective risk mitigation strategies.


2. **Incident Response Plan:**
    - Establish a robust incident response plan to swiftly respond to cyberattacks.
    - Conduct regular incident response drills to test preparedness.


3. **Access Controls:**
    - Implement strong access controls, including multi-factor authentication, to limit unauthorized access.
    - Regularly review and update access privileges.


4. **Data Protection and Privacy:**
    - Protect sensitive data through encryption, tokenization, and other security measures.
    - Comply with data privacy regulations like GDPR and CCPA.


5. **Network Security:**
    - Secure network infrastructure with firewalls, intrusion detection systems, and other security solutions.
    - Regularly patch and update network devices.


6. **Employee Awareness and Training:**
    - Conduct regular cybersecurity awareness training for employees.
    - Promote a culture of security within the organization.


7. **Vendor Risk Management:**
    - Assess and manage the cybersecurity risks associated with third-party vendors.
    - Enforce stringent security requirements for vendors.


8. **Continuous Monitoring and Threat Detection:**
    - Employ advanced security tools to monitor networks, systems, and applications for threats.
    - Implement real-time threat detection and response capabilities.

### The Role of AppSec in CSCRF

Application security is a critical component of the CSCRF, as it focuses on securing web applications and APIs, which are often targeted by cyberattacks. By implementing robust AppSec practices, organizations can protect their digital assets and prevent data breaches.

### How Secure Blink Can Help

At Secure Blink, we understand the complexities of managing cybersecurity in the financial sector. Our flagship product, Threatspy, is an AI-powered Application Security (AppSec) management platform that provides:

- **Comprehensive Web Application & API Security:** Protects your digital infrastructure from the latest web-based threats.

- **Proactive Vulnerability Management:** Identifies and addresses vulnerabilities before they can be exploited by attackers.

- **AI-Driven Prioritization:** Uses AI to prioritize security risks based on their reachability and potential impact.

- **Curated Stack-Oriented Remediation:** Provides tailored solutions for remediation based on your tech stack, making the process efficient and precise.

By leveraging Secure Blink’s solution, financial institutions can effectively implement the CSCRF’s security requirements and safeguard their digital infrastructure.

### Conclusion

The CSCRF provides a comprehensive framework for securing financial institutions against cyber threats. By addressing all aspects of cybersecurity, including AppSec, organizations can build a strong defense against cyberattacks and protect their sensitive data.

The Securities and Exchange Board of India (SEBI) has introduced the Cybersecurity and Cyber Resilience Framework (CSCRF) to bolster the cybersecurity posture of market intermediaries.

SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF)

The rise of digital banks and “neobanks” has transformed the Philippines’s financial landscape in recent years. Encouraged by the government’s ongoing push for digital finance, these institutions offer a fresh alternative to traditional banking. As they don’t have physical branches, digital banks are exclusively accessible on smartphones; thus, you can manage your finances with just a few taps. This convenience—combined with benefits like lower fees, better interest rates, and 24/7 access—makes them an increasingly attractive option for consumers seeking flexibility in managing their money.

Yet, as with any online financial activity, security concerns about digital banks are bound to arise. Entrusting your money to a digital bank often comes with questions like “How safe is my data?” or “Are my transactions protected?” While these are valid concerns, it’s important to remember that the best digital banks will hold themselves to the same consumer protection standards as any traditional financial institution. They offer robust security measures that rival, and in some cases surpass, those of their physical counterparts.

In this article, you can learn more about the essential security features and protocols that a trustworthy digital bank should have. Whether you’re already using a digital bank or just considering one, understanding these measures can give you peace of mind that your money and personal information are well-protected.

## Proper Regulation and Insurance

When you’re placing your hard-earned money in a bank, it helps to know that the institution is operating within a solid legal framework. In the Philippines, one of the most reliable indicators of a digital bank's credibility is its regulation by the Bangko Sentral ng Pilipinas (BSP). A [BSP-supervised digital bank](https://www.mayabank.ph) is required to meet strict capital and liquidity standards and also undergoes regular audits to ensure compliance with banking laws.
On top of that, most BSP-regulated banks—such as Maya, the country’s foremost digital banking institution—are also insured by the Philippine Deposit Insurance Corporation (PDIC). This means that, in the event that the bank is closed or if it declares bankruptcy, your deposits, up to PHP 500,000, are protected. So, when choosing a digital bank, checking for BSP regulation and PDIC insurance should be your first step in assessing its security posture.

## Encryption Standards

Every time you log into a digital banking app, you’re sending and receiving sensitive information like your password, account details, and your transaction history. What protects this data from prying eyes is encryption, a technology that scrambles your information to make it unreadable to unauthorized users. Look for digital banks that use SSL (secure socket layer) or TLS (transport layer security) to secure your data during transmission. Beyond that, end-to-end encryption ensures that even if hackers intercept your data, it will be indecipherable.

## Two-Factor or Multi-Factor Authentication (2FA/MFA)

It’s no longer enough to rely solely on a password to protect your bank account. Today’s hackers have become increasingly sophisticated and passwords—even strong ones—can always be compromised. That’s where two-factor authentication (2FA) or multi-factor authentication (MFA) comes in. These systems require a second form of verification in addition to your password, like a one-time code sent to your phone or a biometric scan. These create an extra barrier for potential intruders.
Many digital banks offer options for both 2FA and MFA, so you can choose what works best for you. When you set these extra layers of protection in place, bad actors won’t be able to access your account without additional verification, even if they do manage to steal your password.

## Fraud Detection and Monitoring Systems

No matter how careful you are, fraudsters are always looking for ways to exploit weaknesses or mistakes. This is why modern digital banks invest heavily in advanced fraud detection and monitoring systems. They use algorithms and machine learning to track your spending patterns and alert you to any unusual activity in real-time. For instance, you might get a notification on your phone because the system noticed an attempt to withdraw money from a location you’ve never visited or a purchase that you don’t usually make. You can then immediately lock your account or notify your bank before any damage is done.

## Data Privacy and Ownership Policies

In the digital age, your personal data is as valuable as your money and protecting it should be a top priority for any bank. A reputable digital bank will have clear, transparent privacy policies outlining how your personal information is handled, processed, stored, and shared. Look for banks that empower you to control your data, with straightforward terms on data collection and usage. Ideally, these policies should ensure that your information is used solely to enhance your banking experience, not sold to third parties for marketing purposes. By understanding a bank’s approach to data privacy and security, you gain the power to make informed decisions that safeguard your personal data along with your financial assets.
 
Security is everything when it comes to digital banking. The better you understand the key features and protocols that safeguard your money and data, the more confident you can be about choosing a bank that meets your needs. In the end, staying informed is your best defense against potential threats, so you can enjoy the convenience of digital banking with your peace of mind intact.

The rise of digital banks and “neobanks” has transformed the Philippines’s financial landscape in recent years. Encouraged by the government’s ongoing push for digital finance, these institutions offer a fresh alternative to traditional banking.

5 Things a Digital Bank Must Have to Know That Your Money Is Truly Secure

Signzy, a vendor providing verification services, confirmed a security incident that has impacted its global clientele, including major banks and fintech companies. The startup, which onboarded over 10 million customers monthly, faced a cyberattack, raising concerns about data safety.

Signzy confirmed the incident without providing details on its nature or scope, citing an ongoing investigation and security reasons. This news comes amid rising concerns over cybersecurity for financial institutions, given that Signzy works with over 600 financial entities, including India's largest banks.

## **Details of the Security Incident**

Multiple sources, including two major Signzy clients—PayU and ICICI Bank—informed [TechCrunch](https://techcrunch.com/2024/12/02/indian-online-id-verification-firm-signzy-confirms-security-incident/) that Signzy fell victim to a cyberattack last week. 

The incident involved sensitive customer data, including personal identification details and financial records, potentially being exposed, as seen in a cybercrime forum post. India’s Computer Emergency Response Team (CERT-In) acknowledged awareness of the incident and mentioned it was actively managing the situation by monitoring affected systems, providing guidance, and coordinating with other agencies.

PayU, one of Signzy’s clients, clarified that it suffered no impact from the attack, likely due to its independent security measures and lack of direct data integration with Signzy's affected systems. 

_"There is no impact on PayU customers or their data due to Signzy's [information](https://www.upguard.com/security-report/signzy) stealer malware,"_ stated Dimple Mehta, a PayU spokesperson. Similarly, ICICI Bank confirmed that their customer data remained unaffected.

## **Uncertain Impact on Customers**

Concerns linger as to the full impact on Signzy’s other customers, which include top financial institutions such as SBI, Mswipe, and Aditya Birla Financial Services, potentially facing data theft or service disruptions. The firm has engaged a professional cybersecurity agency to investigate the breach, but has yet to disclose whether any customer data had been compromised.

Debdoot Majumder, a spokesperson for Signzy, stated that the startup had informed its clients, regulators, and stakeholders of the measures being taken and provided a timeline of the investigation. However, when asked if the company had engaged with the Reserve Bank of India (RBI), Signzy confirmed no such communication had taken place. The RBI did not respond to requests for comment.

## **Rising Concerns Over Data Security**

The incident highlights the increasing threat that cyberattacks pose to financial infrastructure, with cybercrime-related financial losses reaching $4.2 billion globally in 2023, according to industry reports. With over 600 clients, Signzy is a major player in the identity verification ecosystem, providing services across multiple industries. The potential exposure raises significant concerns, especially given the critical nature of ID verification for preventing fraud and financial crimes.

Experts warn that financial institutions must enhance cybersecurity as they increasingly rely on digital onboarding, such as implementing multi-factor authentication, conducting regular security audits, and training employees on phishing prevention. The involvement of information-stealer malware suggests a targeted attack, making it imperative for other stakeholders in the financial sector to assess their security postures by updating software, conducting vulnerability tests, and ensuring timely patch management.

## **Signzy's Action Plan**

Signzy has stated that it is cooperating with authorities and has retained cybersecurity professionals to address the incident, including conducting forensic analysis, securing affected systems, and implementing additional safeguards to prevent future breaches. Backed by investors such as Mastercard, Vertex Ventures, Kalaari Capital, and Gaja Capital, the company is under pressure to ensure that its internal security framework is resilient enough to protect its users.

As part of the ongoing investigation, Signzy's leadership is expected to provide more details regarding how the incident occurred, what data might have been affected, and steps to prevent similar breaches. Investors and clients will be watching closely for updates, particularly given the growth in reliance on digital identity solutions.



Signzy, an online ID verification company, has confirmed a cybersecurity incident that may have exposed customer data. While some clients, including PayU and ICICI Bank, stated they were unaffected

Indian ID Verification Startup Faces Cyberattack, Impact Under Investigation



T-Mobile recently disclosed a security breach involving the Chinese state-sponsored hacking group referred to as "Salt Typhoon", also tracked as Earth Estries, FamousSparrow, Ghost Emperor, and UNC2286. While the hackers exploited vulnerabilities in the company's network routers, T-Mobile's defensive measures reportedly mitigated further damage, securing sensitive customer information.

### Key Incident Details

- 1. Initial Compromise:

Salt Typhoon accessed T-Mobile's network via routers, likely as part of lateral movement efforts to explore network vulnerabilities.

The attack originated from a compromised wireline provider's network, underscoring the risks posed by interconnected systems.



- 2. Detection and Response:

The breach was identified when T-Mobile engineers observed unusual reconnaissance commands on routers, correlating with known Salt Typhoon tactics and indicators of compromise.

Proactive monitoring and network segmentation enabled T-Mobile to block the threat actors before sensitive data was compromised or services disrupted.



- 3. Extent of Damage:

T-Mobile has confirmed that no customer data, including calls, messages, or voicemails, were accessed or stolen.

Connectivity with the compromised provider's network was severed, effectively containing the attack.



- 4. Collaboration and Transparency:

T-Mobile shared findings with federal authorities and industry partners, emphasizing a collaborative approach to tackling cyber threats.




### Broader Implications of Salt Typhoon Activities

This breach is part of a larger wave of telecom attacks attributed to Salt Typhoon, targeting critical infrastructure in Southeast Asia, the United States, and Canada:

#### Targeted Entities:

Telecom providers, including AT&T, Verizon, and Lumen Technologies, alongside government agencies and political institutions.

Attacks extended to private communications, law enforcement data, and wiretapping platforms, reflecting a focus on espionage and intelligence collection.


#### Duration and Impact:

In some cases, breaches persisted for months or longer, allowing hackers to exfiltrate extensive internet traffic and sensitive data.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI confirmed that attackers accessed sensitive communications involving government officials.


#### Geopolitical Context:

Canada's disclosure of network scans linked to Chinese threat actors highlights the global scale of such campaigns, which align with China's broader cyber-espionage strategy.



### Additional Insights: Connections with Volt Typhoon

Though not directly linked to Salt Typhoon, the Chinese Volt Typhoon group recently executed attacks on ISPs and Managed Service Providers (MSPs) in the U.S. and India. These breaches leveraged stolen credentials and zero-day exploits, mirroring the persistence and sophistication seen in the Salt Typhoon campaign.

### Takeaways and Recommendations

- 1. Strengthen Interconnection Security:

Telecom companies must enforce stricter security protocols when interfacing with third-party networks. The breach's origin in a compromised provider highlights the need for secure collaboration.



- 2. Proactive Monitoring and Threat Intelligence:

Continuous network monitoring and real-time threat intelligence sharing, as demonstrated by T-Mobile, are critical in mitigating advanced persistent threats.



- 3. Zero-Trust Architecture:

Implementing a zero-trust framework can limit attackers' ability to navigate laterally within networks after initial compromise.



- 4. Vulnerability Management:

Regular audits and timely patching of known vulnerabilities, such as zero-day exploits seen in Versa Director attacks, are essential.




### Final Note

T-Mobile's response demonstrates the effectiveness of early detection and strong cyber defenses in preventing catastrophic breaches. However, the broader implications of the Salt Typhoon campaign reveal persistent vulnerabilities in the telecommunications sector, warranting enhanced international cooperation and cybersecurity measures.



T-Mobile halts a Chinese state-sponsored cyberattack by Salt Typhoon, safeguarding customer data through proactive monitoring and advanced defenses.



T-Mobile Thwarts Chinese Hackers: Salt Typhoon Telecom Breach Stopped

Earth Estries, a Chinese advanced persistent threat (APT) group, has aggressively targeted critical sectors worldwide. These include telecommunications and government entities across the United States, Asia-Pacific, the Middle East, and South Africa. Utilizing sophisticated techniques and backdoors such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, Earth Estries has carried out prolonged cyber espionage operations, compromising more than 20 organizations.

Key new developments uncovered by Trend Micro include the identification of the new GHOSTSPIDER backdoor, the use of MASOL RAT on Linux devices, and the discovery of complex C&C infrastructure managed by multiple teams. These findings provide valuable insights into Earth Estries' evolving tactics and motivations.

The group exploits server vulnerabilities to gain initial access and uses living-off-the-land binaries (LOLBINs) for lateral movement within networks. The attacks affect sectors like telecommunications, technology, government agencies, and NGOs across regions including Southeast Asia, Africa, and the Americas.

Their complex command-and-control (C&C) infrastructure and overlapping tactics, techniques, and procedures (TTPs) with other known APT groups indicate the possible use of malware-as-a-service (MaaS) tools.

## Introduction to Earth Estries

Since 2023, Earth Estries (also known as Salt Typhoon, FamousSparrow, GhostEmperor, and UNC2286) has emerged as one of the most aggressive Chinese APT groups.&#x20;

Their operations primarily target critical industries such as telecommunications and government sectors across various regions including the US, Asia-Pacific, the Middle East, and South Africa.

## New Backdoors: GHOSTSPIDER and MASOL RAT

The Chinese state-sponsored hacking group Salt Typhoon (also known as Earth Estries, GhostEmperor, UNC2286) has been observed utilizing a new backdoor called **GHOSTSPIDER** in attacks against telecommunication service providers. The backdoor was discovered by Trend Micro, which has been monitoring Salt Typhoon's attacks against critical infrastructure and government organizations worldwide.

Along with **GHOSTSPIDER**, we identified a modular backdoor called **SNAPPYBEE** (aka Deed RAT), which is shared among Chinese APT groups.

Another significant discovery is the cross-platform **MASOL RAT**, initially found during Southeast Asian government incidents in 2020. Recent attacks show that Earth Estries has started deploying MASOL RAT on Linux devices, significantly expanding their reach into government networks that predominantly use Linux systems for critical infrastructure. This move represents an escalation in their tactics, targeting previously unaffected platforms and enhancing their ability to maintain persistence across diverse environments.

## Motivation Behind Attacks

Earth Estries appears to target governments, internet service providers, and consulting firms to gather intelligence more efficiently, thus enabling them to infiltrate their primary targets more effectively.&#x20;



Recently, U.S. authorities confirmed that the Salt Typhoon was behind several breaches of telecommunication service providers in the U.S., including Verizon, AT&T, Lumen Technologies, and T-Mobile. In some cases, they managed to tap into the private communications of U.S. government officials and stole information related to court-authorized wiretapping requests.

Notably, they target both the core services (like database and cloud servers) of telecommunications firms and the networks of their vendors. A notable tactic is the deployment of a **DEMODEX rootkit** on vendor machines. This rootkit has been utilized to facilitate deeper access into target networks.

## Victimology and Attack Spread



Earth Estries has successfully compromised more than 20 organizations in industries such as telecommunications, technology, consulting, chemicals, and transportation, as well as government agencies and NGOs. The victims are spread across multiple countries, including Afghanistan, Brazil, Eswatini, India, Indonesia, Malaysia, Pakistan, the Philippines, South Africa, Taiwan, Thailand, the US, and Vietnam.



These countries and industries are being targeted due to their strategic importance in regional stability, economic influence, and technological development. By compromising government and telecommunications sectors, Earth Estries can gather valuable intelligence, disrupt communication channels, and maintain persistent surveillance over critical infrastructure. Additionally, targeting consulting firms and NGOs that work closely with government entities allows them to indirectly access sensitive data and enhance their understanding of political dynamics.

## Initial Access and Exploitation Techniques

Earth Estries aggressively targets public-facing servers by exploiting well-known vulnerabilities. Some of the vulnerabilities exploited by the group include:

- **Ivanti Connect Secure VPN (CVE-2023-46805, CVE-2024-21887):** Exploited for arbitrary command execution.
- **Fortinet FortiClient EMS (CVE-2023-48788):** SQL injection vulnerability.
- **Sophos Firewall (CVE-2022-3236):** Code injection allowing remote code execution.
- **Microsoft Exchange (ProxyLogon CVE-2021 series):** Remote code execution vulnerabilities.

After gaining access, attackers utilize LOLBINs such as **WMIC.exe** and **PSEXEC.exe** for lateral movement. Malware like **SNAPPYBEE**, **DEMODEX**, and **GHOSTSPIDER** is then deployed for long-term espionage.

## Campaign Details and Infrastructure Analysis

### Campaign Alpha and Beta



Earth Estries appears to be a well-organized group with a clear division of labor, launching attacks across various regions and industries. Two key campaigns highlighted in Trend Micro's report are **Campaign Alpha** and **Campaign Beta**.



**Campaign Alpha** involved attacks on the Taiwanese government and chemical companies, primarily aiming to steal sensitive information related to government operations and industrial processes. The attackers downloaded malicious tools from their C&C server and deployed rootkits such as DEMODEX to maintain persistence and gather intelligence.



**Campaign Beta** was a long-term espionage campaign targeting telecommunications companies and government entities across Southeast Asia. The goal was to disrupt communication channels and maintain long-term surveillance over critical infrastructure. This campaign utilized backdoors like **GHOSTSPIDER** and the **DEMODEX** rootkit for extended monitoring. These campaigns suggest that Earth Estries uses distinct infrastructure teams for different attacks, highlighting the complexity of their operations.



### GHOSTSPIDER Analysis



**GHOSTSPIDER** is a sophisticated, multi-modular backdoor designed for long-term espionage operations requiring high levels of stealth, achieved through encryption and residing solely in memory. It is loaded on the target system using DLL hijacking and registered as a service via the legitimate **regsvr32.exe** tool, while a secondary module, the beacon loader, loads encrypted payloads directly in memory.



GHOSTSPIDER communicates with its C&C server using a custom protocol protected by **Transport Layer Security (TLS)**, which makes it challenging to intercept and analyze. The backdoor executes commands received from the command and control (C2) server, concealed within HTTP headers or cookies to blend with legitimate traffic.



The backdoor supports various commands, such as uploading malicious modules into memory, creating necessary resources, executing primary functions, and maintaining periodic communication with the C&C server. This modular design gives GHOSTSPIDER significant versatility and adaptability, allowing Salt Typhoon to adjust their attack as needed depending on the victim's network and defenses.

## Command-and-Control (C&C) Infrastructure

The C&C infrastructure managed by Earth Estries involves multiple teams, each responsible for different backdoors. For example, **SNAPPYBEE** C&C domains have WHOIS information that overlaps with other known operations, suggesting shared tools or collaboration between different APT groups. This approach helps the group maintain a decentralized and flexible attack framework, making it harder for defenders to identify and counter their operations.

## Attribution and Overlapping TTPs

Some TTPs used by Earth Estries overlap with those employed by **FamousSparrow** and **GhostEmperor**.&#x20;

The use of shared tools, such as **ShadowPad** and **MASOL RAT**, suggests that Earth Estries may source its tools from malware-as-a-service providers. This highlights the likelihood of collaboration or shared resources between Chinese APT groups.

## Post-Exploitation Activities

During post-exploitation, Earth Estries uses LOLBINs and customized malware for further infiltration and to maintain persistence. This includes executing PowerShell commands to deploy rootkits like **DEMODEX** and spreading through targeted environments, often using **SoftEther VPN** to mask their C&C activities.

## What's Next

Earth Estries, also known as Salt Typhoon, continues to be one of the most aggressive Chinese APT groups, leveraging sophisticated tactics to compromise critical infrastructure. Their attacks are characterized by stealth, the use of living-off-the-land tools, and the deployment of shared backdoors, making them challenging to detect and counter. U.S. authorities have recently notified numerous victims of breaches involving Salt Typhoon, emphasizing the need for vigilance.

Organizations must strengthen their cybersecurity, focusing on practices such as multi-layered security, regular patching, and enhanced network visibility. Employing tools like **Trend Micro Vision One™** can help organizations effectively monitor and mitigate these advanced threats.



Earth Estries hackers exploit GhostSpider malware to backdoor telecoms globally, compromising critical infrastructure and government networks

Our Product

Resource Library

Subscribe to Our Weekly Threat Digest

Contact Us

PRODUCT

threatspyBulk IP/Domain Lookup

threatspy

Bulk IP/Domain Lookup

SOLUTIONS

By Industry

Healthcare

Healthcare

Education

Education

IT & Telecom

IT & Telecom

By Role

Government

Government

CISO/CTO

CISO/CTO

DevSecOps

DevSecOps

RESOURCES

Threat Feed

Threat Feed

Threat Research

Threat Research

White Paper

White Paper

SB Blogs

SB Blogs

COMPANY

Our Story

Our Story

Our Team

Our Team

Career

Career

Press And Media

Press And Media

Contact Us

Contact Us

Quantum Cryptography

Stay Cyber-Updated

Ready to get started?

Product

Solutions

Resources

Company

Find Us Online

contact@secureblink.com

@ Copyright 2024 Secure Blink. All rights reserved.

4th Floor, Plot No- 7-10 Sector 126, Noida, UP -201303

threatspy
Bulk IP/Domain Lookup