Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

TrendAI Vision One reports that the Earth Estries APT has conducted prolonged, sophisticated espionage campaigns since 2020 against telecommunications, government, and related service providers across multiple regions; the report details initial access via public-facing server vulnerabilities (including multiple CVEs and ProxyLogon), the use of living-off-the-land tools and custom backdoors/rootkits (DEMODEX, GHOSTSPIDER, SNAPPYBEE, MASOL RAT), C2 infrastructure analysis, victimology spanning 20+ organizations in numerous countries, and operational attribution/overlap with other Chinese APT toolsets.