Earth Alux Hackers Deploy VARGIET Malware in Targeted Organizational Attacks

**Executive Summary:** Earth Alux is a China-linked advanced persistent threat that has used the multi-stage VARGEIT backdoor, along with RAILLOAD and RAILSETTER, to conduct targeted cyberespionage against government, technology, logistics, manufacturing, telecommunications, and retail organizations across APAC and expanding into Latin America; the report highlights DLL side-loading, process injection (e.g., into mspaint.exe), multi-channel encrypted command-and-control (HTTP, reverse TCP/UDP, Microsoft Graph), and advanced persistence and evasion techniques.