THE RISE OF COLLABORATIVE TACTICS AMONG CHINA-ALIGNED CYBER ESPIONAGE CAMPAIGNS

Summary from the TLDR InfoSec newsletter

Trend Micro researchers identified a sophisticated "Premier Pass-as-a-Service" model where China-aligned APT groups Earth Estries and Earth Naga collaborate by sharing access to compromised networks, with Earth Estries acting as an access broker that hands off already-compromised systems to Earth Naga for continued exploitation. The attacks targeted government agencies and telecommunications providers across APAC, Southeast Asia, and NATO countries using multiple deployment vectors, including CrowDoor backdoors, ShadowPad malware, and Cobalt Strike beacons delivered through DLL side-loading and compromised credentials. This emerging collaboration pattern complicates attribution efforts and represents an evolution beyond traditional initial access brokers, as threat actors share access at later stages of the kill chain (command-and-control phase) rather than just initial entry points, requiring defenders to move beyond process chain analysis and monitor for suspicious file deployments and unauthorized remote administration tools.