Earth Krahang APT Group: Global Government Cyberespionage Campaigns (2022–2024) and TTP Analysis

Earth Krahang is an APT-style threat actor active since early 2022 that targets government organizations across multiple continents; the group leverages compromised government infrastructure to host payloads and send spear‑phishing from trusted accounts, uses automated scanning and public‑facing application exploits (including CVE-2023-32315 and CVE-2022-21587), deploys malware and tooling such as Xdealer, Cobalt Strike, and SoftEther VPN for persistence and lateral movement, and has been linked to roughly 70 victims across 23 countries with at least 48 confirmed government entities compromised.