File · Earth Kapre · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 41 techniques across 11 tactics
Analyst brief
misp-galaxy + mitre-attackEarth Kapre is an APT group specializing in cyberespionage. They target organizations in various countries through phishing campaigns using malicious attachments to infect machines. Earth Kapre employs techniques like abusing PowerShell, curl, and Program Compatibility Assistant to execute malicious commands and evade detection within targeted networks. The group has been active since at least 2018 and has been linked to multiple incidents involving data theft and espionage.
Kill chain
MITRE ATT&CK Enterprise · tap a technique41 techniques · 11 of 15 tactics
Resource development
1 techniqueInitial access
3 techniquesExecution
7 techniquesPersistence
1 techniqueStealth
6 techniquesCredential access
4 techniquesDiscovery
6 techniquesLateral movement
1 techniqueCollection
6 techniquesCommand and control
4 techniquesExfiltration
2 techniques
select a technique
Take it with you
keyless · no signupReferences
5 sourcesTrack Earth Kapre on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.