Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Earth Lamia · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Earth Lamia

  • UNC5454

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE8 new CVEs: CVE-2021-22205, CVE-2024-27198, CVE-2024-51378, CVE-2024-51567, CVE-2024-56145, CVE-2024-9047 +2 more

Analyst brief

misp-galaxy

Earth Lamia is a China-nexus APT that targets organizations across multiple sectors, including finance, logistics, and government, primarily in Latin America, the Middle East, and Southeast Asia. The actor exploits web application vulnerabilities, such as CVE-2025-55182, and employs techniques like SQL injection, DLL sideloading, and the deployment of custom backdoors like PULSEPACK and BypassBoss. Earth Lamia conducts reconnaissance, file operations, and credential theft, often utilizing tools like Cobalt Strike and VShell.

CVEs Earth Lamia is cited as exploiting

2 on CISA KEV
  1. CVE-2025-55182KEV2026-10-17
    1. “Within hours of CVE-2025-55182 disclosure on December 3, 2025, Amazon Web Services observed exploitation attempts from infrastructure linked to Earth Lamia.”

      cited as exploiting · source: blog.polyswarm.io ↗ · 2026-10-17

    2. “Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.”

      cited as exploiting · source: aws.amazon.com ↗ · 2026-10-17

  2. CVE-2025-31324KEV2026-10-17
    1. “More recently, Earth Lamia also exploited CVE-2025-31324 (SAP NetWeaver Visual Composer unauthenticated file upload vulnerability).”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

  3. CVE-2024-515672026-10-17
    1. “CVE-2024-51567 : CyberPanel remote code execution vulnerability”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  4. CVE-2024-561452026-10-17
    1. “CVE-2024-56145 : Craft CMS remote code execution vulnerability”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  5. CVE-2024-271982026-10-17
    1. “CVE-2024-27198 : JetBrains TeamCity authentication bypass vulnerability”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  6. CVE-2024-513782026-10-17
    1. “CVE-2024-51378 : CyberPanel remote code execution vulnerability”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  7. CVE-2024-90472026-10-17
    1. “CVE-2024-9047 : WordPress File Upload plugin arbitrary file access vulnerability”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  8. CVE-2021-222052026-10-17
    1. “CVE-2021-22205 : GitLab remote code execution vulnerability”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

2 sources
  1. 1.cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-…
  2. 2.trendmicro.com/en_us/research/25/e/earth-lamia.html

Track Earth Lamia on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.