Date: 11/27/2024
Severity: Critical
Summary
Trend Micro research reveals a spear-phishing campaign targeting individuals and organizations in Japan since June 2024. Notably, this campaign marks the return of the ANEL backdoor, previously used by APT10 in attacks on Japan until around 2018, but not observed since. Additionally, NOOPDOOR, associated with Earth Kasha, has also been confirmed in this campaign. These findings suggest the campaign is part of a new operation by Earth Kasha.
Indicators of Compromise (IOC) List
IP Address : | 139.84.131.62 139.84.136.105 45.32.116.146 45.77.252.85 208.85.18.4 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
IP Address : | dstipaddress IN ("139.84.131.62","139.84.136.105","45.32.116.146","45.77.252.85","208.85.18.4") or ipaddress IN ("139.84.131.62","139.84.136.105","45.32.116.146","45.77.252.85","208.85.18.4") or publicipaddress IN ("139.84.131.62","139.84.136.105","45.32.116.146","45.77.252.85","208.85.18.4") or srcipaddress IN ("139.84.131.62","139.84.136.105","45.32.116.146","45.77.252.85","208.85.18.4") |
Reference:
https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html