'Earth Lamia' Exploits Known SQL, RCE Bugs Across Asia

Earth Lamia, a China-linked threat actor active since 2023, is conducting an ongoing campaign exploiting unpatched, Internet-exposed servers across South and Southeast Asia (with activity noted in India and Brazil). The group uses SQL injection and multiple known RCE vulnerabilities — most recently the critical CVE-2025-31324 in SAP NetWeaver — to drop a modular backdoor called PulsePack that communicates with C2 servers and fetches additional plugins; attackers also use OSS tooling (lightly obfuscated) for privilege escalation, credential theft, and persistence, targeting governments, education, IT, logistics, retail, and financial organizations.