Ted Lee
10 articles
-
Blog汎用性の高いLOLBin悪用フレームワーク「PeckBirdy」：中国系の攻撃グループが利用
PeckBirdyは、中国系APTグループが用いるJScript型のLOLBin悪用フレームワークです。多くの環境に適応できることから、ギャンブル組織や行政機関に対するバックドア攻撃に利用されています。
January 26th, 2026 12 minTed Lee, Joseph C Chen
Read article -
BlogNew Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises
We uncovered a campaign that makes use of Charon, a new ransomware family, and advanced APT-style techniques to target organizations with customized ransom demands.
August 12th, 2025 8 minJacob Santos, Ted Lee, Ahmed Kamal, Don Ovid Ladores
Read article -
BlogThe Espionage Toolkit of Earth Alux: A Closer Look at its Advanced Techniques
The cyberespionage techniques of Earth Alux, a China-linked APT group, are putting critical industries at risk. The attacks, aimed at the APAC and Latin American regions, leverage powerful tools and techniques to remain hidden while stealing sensitive data.
March 31st, 2025 14 minLenart Bermejo, Ted Lee, Theo Chen
Read article -
BlogChinese-Speaking Group Manipulates SEO with BadIIS
This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment.
February 7th, 2025 5 minTed Lee, Lenart Bermejo
Read article -
BlogGame of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions
Since 2023, APT group Earth Estries has aggressively targeted key industries globally with sophisticated techniques and new backdoors, like GHOSTSPIDER and MASOL RAT, for prolonged espionage operations.
November 25th, 2024 17 minLeon M Chang, Theo Chen, Lenart Bermejo, Ted Lee
Read article -
BlogBreaking Down Earth Estries' Persistent TTPs in Prolonged Cyber Operations
Discover how Earth Estries employs a diverse set of tactics, techniques, and tools, including malware such as Zingdoor and Snappybee, for its campaigns.
November 8th, 2024 16 minTed Lee, Leon M Chang, Lenart Bermejo
Read article -
BlogEarth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC
We observed Earth Baxia carrying out targeted attacks against APAC countries that involved advanced techniques like spear-phishing and customized malware, with data suggesting that the group operates from China.
September 19th, 2024 10 minTed Lee, Cyris Tseng, Pierre Lee, Sunny Lu…
Read article -
BlogEarth Preta Evolves its Attacks with New Malware and Strategies
In this blog entry, we discuss our analysis of Earth Preta’s enhancements in their attacks by introducing new tools, malware variants and strategies to their worm-based attacks and their time-sensitive spear-phishing campaign.
September 9th, 2024 11 minLenart Bermejo, Sunny Lu, Ted Lee
Read article -
BlogEarth Estries Targets Government, Tech for Cyberespionage
We break down a new cyberespionage campaign deployed by a cybercriminal group we named Earth Estries. Analyzing the tactics, techniques, and procedures (TTPs) employed, we observed overlaps with the advanced persistent threat (APT) group FamousSparrow as Earth Estries targets governments and organizations in the technology sector.
August 30th, 2023 12 minTed Lee, Lenart Bermejo, Hara Hiroaki, Leon M Chang…
Read article -
ResearchEarth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign
Our research provides a detailed analysis of the new tools and techniques used by Earth Baku in its cyberespionage campaign against organizations in the Indo-Pacific region.
August 24th, 2021 4 minHara Hiroaki, Ted Lee
Read article