The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Trend Micro identified a new “Premier Pass-as-a-Service” model where China-aligned APT groups Earth Estries and Earth Naga are basically timesharing network access like a cybercrime co-working space. Earth Estries breaks in with its CrowDoor backdoor, then uses Cobalt Strike to plant a ShadowPad implant that phones home to Earth Naga’s infrastructure, handing over the keys to government and telecom targets in APAC and NATO countries. The upstream partner is no newcomer: Trend Micro’s earlier Earth Estries report counted more than 20 compromised organizations in 13 countries, mostly telecoms and government entities. Earth Naga, which Microsoft tracks as Flax Typhoon, has spent years quietly living off the land in Taiwanese networks with legitimate tools such as the SoftEther VPN client. This unprecedented level of APT collaboration means defenders can no longer rely on simple attribution: welcome to the threat actor alliance ecosystem.