Earth Baku campaign

Earth Baku, a threat actor linked to APT41, has extended its operations beyond the Indo-Pacific, targeting regions across Europe, the Middle East, and Africa, including countries such as Italy, Germany, the UAE, and Qatar, with suspected activities in Georgia and Romania. The group exploits public-facing applications, notably IIS servers, as entry points, deploying advanced malware toolsets like the Godzilla webshell and customized loaders StealthVector and StealthReacher. These loaders employ techniques such as AES encryption and code obfuscation to launch backdoor components stealthily. Earth Baku's latest backdoor, SneakCross, utilizes Google services for command-and-control activities and features a modular design for easy updates. In their post-exploitation phase, they maintain persistence with tools like a customized iox tool, Rakshasa, and Tailscale, and use MEGAcmd for data exfiltration. This expansion and evolution in their tactics underscore the increasing complexity and threat posed by Earth Baku to global cybersecurity defenses.