[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ft0CoSZJzU-JINQeGMGRxYkQCMnZNsQQiEFwMNyw40_o":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":11,"target_industries":12,"target_countries":13,"incident_types":14,"references":15,"techniques":20,"technique_count":21,"created_at":22,"seoMetadata":23,"schemaOrg":27},"Earth Baxia","earth-baxia",[],"Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear-phishing emails and exploiting the GeoServer vulnerability CVE-2024-36401 for remote code execution, deploying customized Cobalt Strike components with altered signatures, leveraging GrimResource and AppDomainManager injection techniques to deliver additional payloads, and utilizing a new backdoor named EAGLEDOOR for multi-protocol communication and payload delivery.","CN",null,[],[],[],[16,17,18,19],"https:\u002F\u002Fwww.tgsoft.it\u002Fnews\u002Fnews_archivio.asp?id=1568","https:\u002F\u002Fjp.security.ntt\u002Ftech_blog\u002Fappdomainmanager-injection","https:\u002F\u002Fwww.trendmicro.com\u002Fen_us\u002Fresearch\u002F24\u002Fi\u002Fearth-baxia-spear-phishing-and-geoserver-exploit.html","https:\u002F\u002Fwww.trendmicro.com\u002Fcontent\u002Fdam\u002Ftrendmicro\u002Fglobal\u002Fen\u002Fresearch\u002F24\u002Fi\u002Fearth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac\u002FIOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt",[],0,"2024-09-26T01:15:04.492733+00:00",{"title":24,"metaDescription":25,"keywords":26},"Earth Baxia Threat Actor Profile | EdgeProtect","Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC region, using spear...","Earth Baxia, threat actor, APT, cyber threat, threat intelligence, CN",{"@context":28,"@type":29,"name":6,"alternateName":30,"description":9,"url":31,"mainEntityOfPage":32,"location":34},"https:\u002F\u002Fschema.org","Organization",[],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fearth-baxia",{"@type":33,"@id":31},"WebPage",{"@type":35,"name":10},"Country"]