File · Earth Estries · Unknown · misp-galaxy · refreshed 2026-10-06
Earth Estries
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- 2026-10-18todaynew CVE1 new CVE: CVE-2025-5777
Analyst brief
misp-galaxyTrend Micro found that Earth Estries relies heavily on DLL sideloading to load various tools within its arsenal. Aside from the backdoors previously mentioned, this intrusion set also utilizes commonly used remote control tools like Cobalt Strike, PlugX, or Meterpreter stagers interchangeably in various attack stages. These tools come as encrypted payloads loaded by custom loader DLLs.
CVEs Earth Estries is cited as exploiting
1 on CISA KEV- CVE-2025-5777KEV2026-10-17
“Starting in July, we identified Earth Estries exploiting CVE-2025-5777 to attack Citrix devices.”
cited as exploiting · source: trendmicro.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
2 sourcesTrack Earth Estries on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.