File · Earth Krahang · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Earth Krahang

sigil · no ATT&CK coverage stated

What changed

ledger · newest first

2026-10-18todaynew CVE5 new CVEs: CVE-2016-5195, CVE-2021-22555, CVE-2021-4034, CVE-2022-21587, CVE-2023-32315

Analyst brief

misp-galaxy

Earth Krahang is an APT group targeting government organizations worldwide. They use spear-phishing emails, weak internet-facing servers, and custom backdoors like Cobalt Strike, RESHELL, and XDealer to conduct cyber espionage. The group creates VPN servers on infected systems, employs brute force attacks on email accounts, and exploits compromised government infrastructure to attack other governments. Earth Krahang has been linked to another China-linked actor, Earth Lusca, and is believed to be part of a specialized task force for cyber espionage against government institutions.

CVEs Earth Krahang is cited as exploiting

none on KEV

CVE-2023-323152026-10-17
1. “The threat actors use open-source tools to search public-facing servers for specific vulnerabilities like CVE-2022-21587 (Control Web Panel) and CVE-2023-32315 (Openfire). They use web shells to get unauthorized access and persist on victim networks by taking advantage of these security flaws.”
  cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17
2. “The threat actor abused the following vulnerabilities multiple times: CVE-2023-32315 : command execution on OpenFire”
  cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17
CVE-2022-215872026-10-17
1. “The threat actors use open-source tools to search public-facing servers for specific vulnerabilities like CVE-2022-21587 (Control Web Panel) and CVE-2023-32315 (Openfire). They use web shells to get unauthorized access and persist on victim networks by taking advantage of these security flaws.”
  cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17
2. “CVE-2022-21587 : command execution on Oracle Web Applications Desktop Integrator”
  cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17
CVE-2016-51952026-10-17
1. “Exploiting CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195 for privilege escalation on Linux systems”
  cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17
CVE-2021-225552026-10-17
1. “Exploiting CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195 for privilege escalation on Linux systems”
  cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17
CVE-2021-40342026-10-17
1. “Exploiting CVE-2021-4034, CVE-2021-22555, and CVE-2016-5195 for privilege escalation on Linux systems”
  cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

2 sources

Track Earth Krahang on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.