← All actors Recent activity

EARTHKURMA

EARTHKURMA · dmloader · dunloader · frpc · icmpinger · kmlog · krnrat · ladon · moriya · nbtscan · odriz · simpoboxspy · tesdat · wmihacker

Indicators
18
Source reports
2
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02

Overview 18 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

ipv47EARTHKURMA.json
url7EARTHKURMA.json
domain4EARTHKURMA-domain.txt

Principal sources 2 reports

Ranked by how many of this actor's indicators each report brought in.

Timeline 18 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. or earlier 4 domain, 7 ipv4, 7 urlthis year

    trendmicro.com/en_us/research/25/d/earth-kurma-apt-cam… · documents.trendmicro.com/assets/txt/EarthKurma-IOCssVJ3RcK.txt

    domaindfsg3gfsga.space
    domainigtsadlb2ra.pw
    domainihyvcs5t.pw
    domainvidsec.cc
    ipv4103.238.214.88:443
    ipv4149.28.147.63:443
    ipv4166.88.194.53:443
    ipv4185.239.225.106:443
    ipv438.147.191.103:443
    ipv438.60.199.225:443
    ipv445.77.250.21:443
    urlhttp://103.238.214.88
    urlhttp://149.28.147.63
    urlhttp://166.88.194.53
    urlhttp://185.239.225.106
    urlhttp://38.147.191.103
    urlhttp://38.60.199.225
    urlhttp://45.77.250.21

Further reading 2