Earth Kasha Returns with New Tools in Its Cyber Espionage Campaign

A new espionage campaign by Earth Kasha, part of China’s APT10, is targeting government and public institutions in Taiwan and Japan. The attackers use spear-phishing emails with malicious Excel files to deploy ROAMINGMOUSE, which drops and runs malware through DLL sideloading. This leads to the in-memory execution of ANEL and, later, the stealthy NOOPDOOR backdoor, which supports encrypted DNS communications and evasion techniques, demonstrating Earth Kasha’s continued evolution in cyber-espionage.