Earth Kasha’s Campaign Exploiting Fortinet Vulnerability (Campaign)

Earth Kasha, an actor active since 2019 and linked to the broader APT10 umbrella, launched a 2023 campaign targeting Japan, Taiwan, and India by exploiting Fortinet CVE-2023-27997 to gain access. The campaign uses DLL side-loading, phishing, credential theft and deploys LODEINFO, NOOPDOOR, MirrorStealer and Cobalt Strike for persistence, credential exfiltration, and data theft; overlaps with other China-linked groups suggest possible 0-day sharing or third-party access brokers.