---
title: Winnti Subgroup Earth Longzhi Uses New TTPs
description: Trend Micro recently reported that Earth Longzhi was observed using new TTPs, including stack rumbling.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Winnti Subgroup Earth Longzhi Uses New TTPs](https://blog.polyswarm.io/winnti-subgroup-earth-longzhi-uses-new-ttps)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | May 19, 2023 6:28:29 PM

**Related Families:** Croxloader, SPHijacker, Behinder  
**Verticals Targeted:** Government, Healthcare, Technology, Manufacturing

**Executive Summary**

## Earth Longzhi, a Winnti subgroup, was recently observed using new TTPs, including a novel technique dubbed stack rumbling.

**Key Takeaways**

- Earth Longzhi, a subgroup of Winnti, was recently observed using new TTPs.
- The group has transitioned from using maldocs to exploiting public-facing applications for initial infection.
- The group is using legitimate Windows Defender executables for DLL sideloading, using BYOVD to disable security products, and using RPC to install drivers as kernel-level services. 
- Earth Lonhzhi’s most interesting new TTP is stack rumbling, which uses IFEO to disable security products. 

**Recent Activity **

Earth Longzhi, a Winnti subgroup, was recently observed using new TTPs. Trend Micro [reported](https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html) on this activity. Targets included entities in Taiwan, Thailand, the Philippines, and Fiji.

In the recently observed campaigns, Earth Longzhi decided to forgo phishing emails with maldocs and instead exploited public-facing applications such as IIS and Exchange servers to install the Behinder webshell. Behinder offers multiple backdoor functions, including RCE, file operation, interactive shell, and Socks5 proxy. The threat actors can use this tool to deploy other payloads.

The threat actors used *MpDlpCmd.exe* and *MpCmdRun.exe,* legitimate Windows Defender executables, to perform DLL sideloading. Malware families launched using this technique include Croxloader and SPHijacker.

They also exploited *zamguard64.sys*, a vulnerable driver. By exploiting this driver, Earth Longzhi was able to use a bring-your-own-vulnerable-driver (BYOVD) attack to disable security products on the victim machine.

Earth Longzhi also installed drivers as kernel-level services by using RPC instead of general Windows APIs, a method that can be used to evade API call monitoring.

The most interesting new TTP used by Earth Longzhi is what Trend Micro calls “stack rumbling.” The group uses stack rumbling to disable security products using Image File Execution Options (IFEO), a new denial of service technique.

Trend Micro warned the group appears to be expanding its repertoire and will likely become more active in the near future.

**Who is Earth Longzhi?**

### Earth Longzhi is a China nexus threat actor group operating under the Winnti umbrella. The group has been active since at least 2020 and is known to target government, infrastructure, defense, aviation, insurance, health, and financial entities in Taiwan, China, Thailand, Malaysia, Indonesia, Pakistan, and Ukraine.

**IOCs**

PolySwarm has multiple samples associated with this activity.

 

[16887b36f87a08a12fe3b72d0bf6594c3ad5e6914d26bff5e32c9b44acfec040](https://polyswarm.network/scan/results/file/16887b36f87a08a12fe3b72d0bf6594c3ad5e6914d26bff5e32c9b44acfec040)<https://samples.vx-underground.org/APTs/2023/2023.05.02/Samples/16887b36f87a08a12fe3b72d0bf6594c3ad5e6914d26bff5e32c9b44acfec040.7z>

[21ffa168a60f0edcbc5190d46a096f0d9708512848b88a50449b7a8eb19a91ed](https://polyswarm.network/scan/results/file/21ffa168a60f0edcbc5190d46a096f0d9708512848b88a50449b7a8eb19a91ed)

[39de0389d3186234e544b449e20e48bd9043995ebf54f8c6b33ef3a4791b6537](https://polyswarm.network/scan/results/file/39de0389d3186234e544b449e20e48bd9043995ebf54f8c6b33ef3a4791b6537)

[7910478d53ab5721208647709ef81f503ce123375914cd504b9524577057f0ec](https://polyswarm.network/scan/results/file/7910478d53ab5721208647709ef81f503ce123375914cd504b9524577057f0ec)

[9eceba551baafe79b45d412c5347a3d2a07de00cc23923b7dee1616dee087905](https://polyswarm.network/scan/results/file/9eceba551baafe79b45d412c5347a3d2a07de00cc23923b7dee1616dee087905)<https://samples.vx-underground.org/APTs/2023/2023.05.02/Samples/9eceba551baafe79b45d412c5347a3d2a07de00cc23923b7dee1616dee087905.7z>

[Ebf461be88903ffc19363434944ad31e36ef900b644efa31cde84ff99f3d6aed](https://polyswarm.network/scan/results/file/Ebf461be88903ffc19363434944ad31e36ef900b644efa31cde84ff99f3d6aed)

 

You can use the following CLI command to search for all related samples in our portal:

**$ polyswarm link list -f EarthLongzhi**

 

***Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports***

 

[View full post](https://blog.polyswarm.io/winnti-subgroup-earth-longzhi-uses-new-ttps)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2023-06-23T16:51:54.707Z",
  "datePublished" : "2023-05-19T18:28:29Z",
  "headline" : "Winnti Subgroup Earth Longzhi Uses New TTPs",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/WINNTI.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/winnti-subgroup-earth-longzhi-uses-new-ttps",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```