The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

This Trend Research report documents coordinated operations between China-aligned APTs Earth Estries and Earth Naga, where Earth Estries acted as an access broker enabling Earth Naga deployments (notably ShadowPad) across telecom, government, and other strategic sectors in APAC, NATO countries, and beyond; it details infection chains, malware families (CrowDoor, ShadowPad, Draculoader, Cobalt Strike), timelines from 2023–2025, proposed categories of collaborative attacks (Types A–D), the emerging “Premier Pass-as-a-Service” model, and defensive recommendations including IOC hunting and monitoring of edge devices.