{"id":211060,"date":"2024-03-28T09:01:19","date_gmt":"2024-03-28T09:01:19","guid":{"rendered":"https:\/\/www.techopedia.com\/?p=211060"},"modified":"2024-03-28T09:01:19","modified_gmt":"2024-03-28T09:01:19","slug":"how-earth-krahang-breached-48-governments-across-the-world-expert-analysis","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world","title":{"rendered":"How &#8216;Earth Krahang&#8217; Breached 48 Governments Across the World: Expert Analysis"},"content":{"rendered":"<p>The Chinese hacking saga against the U.S. and the U.K. continues to heat up. Targeted countries have set new criminal charges and sanctions against the hacking group APT31 \u2014 allegedly running cyber espionage attacks on behalf of China\u2019s civilian intelligence agency.<\/p>\n<p>However, security experts warn that another threat actor known as Earth Krahang, also allegedly tied to the government of China, has been coordinating attacks against governments in Southeast Asia, Europe, America, and Africa since 2022.<\/p>\n<p>Techopedia sat with cybersecurity and national security experts to understand who Earth Krahang is, what their motives, technologies, and techniques are, and why the group should be taken seriously.<\/p>\n<div class=\"su-note\"  style=\"border-color:#dddddd;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px;\"><div class=\"su-note-inner su-u-clearfix su-u-trim\" style=\"background-color:#f7f7f7;border-color:#ffffff;color:#333333;border-radius:3px;-moz-border-radius:3px;-webkit-border-radius:3px;\">\n<h2><span id=\"key_takeaways\">Key Takeaways<\/span><\/h2>\n<ul>\n<li>As China-supported cyber espionage operations are revealed to the world, the country faces criticism and sanctions from the U.S. and the U.K.<\/li>\n<li>A new China-linked hacking group called Earth Krahang has been targeting governments in Southeast Asia, Europe, America, and Africa since 2022.<\/li>\n<li>Earth Krahang leverages vulnerabilities in public-facing services and uses spear-phishing emails to compromise systems.<\/li>\n<li>Earth Krahang is likely linked to the Chinese company I-Soon, which has been accused of acting as an APT-for-hire for the Chinese government.<\/li>\n<li>The ultimate goal of Earth Krahang is cyberespionage, and government organizations are their primary targets.<\/li>\n<li>Experts explain Earth Krahang&#8217;s activities and how they are impacting the current state of cyber warfare by creating a false-flag operation that misdirects suspicion and disrupts international relations.<\/li>\n<\/ul>\n<\/div><\/div>\n<div>\n    <section class=\"toc-sticky w-100 bg-white \">\n        <div class=\"toc-sticky__container container\">\n            <div class=\"toc-sticky__open d-flex align-items-end\" data-bs-toggle=\"collapse\"\n                 aria-controls=\"multiCollapse1\"\n                 data-bs-target=\"#multiCollapse1\">\n                <button\n                        class=\"btn btn-primary collapse-action-btn p-1 rounded-circle\"\n                        type=\"button\"\n                >\n                    <i class=\"icon-chevron-up\"><\/i>\n                <\/button>\n                <span id=\"toc-current-title\" class=\"d-flex align-items-center\">\n                    Table of Contents\n                <\/span>\n                <span class=\"toc-main-title-permanent\">Table of Contents<\/span>\n            <\/div>\n            <div\n                    class=\"collapse my-3\"\n                    id=\"multiCollapse1\"\n            >\n                <ol class=\"StepProgress\">\n                                                                        <li class=\"StepProgress-item current\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"key_takeaways\"\n                               onclick=handleScrollToTitle(\"key_takeaways\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Key Takeaways<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"experts_answer_who_is_earth_krahang\"\n                               onclick=handleScrollToTitle(\"experts_answer_who_is_earth_krahang\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Experts Answer: Who is Earth Krahang?<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"understanding_the_motives_behind_state-supported_hackers\"\n                               onclick=handleScrollToTitle(\"understanding_the_motives_behind_state-supported_hackers\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Understanding the Motives Behind State-Supported Hackers<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"patriotism_entrapment_and_forced_cooperation\"\n                               onclick=handleScrollToTitle(\"patriotism_entrapment_and_forced_cooperation\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Patriotism, Entrapment, and Forced Cooperation<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"earth_krahang_a_jack_of_all_trades\"\n                               onclick=handleScrollToTitle(\"earth_krahang_a_jack_of_all_trades\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Earth Krahang: \u201cA Jack of All Trades\u201d<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"earth_krahangs_ultimate_goal_and_hacking_technologies\"\n                               onclick=handleScrollToTitle(\"earth_krahangs_ultimate_goal_and_hacking_technologies\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Earth Krahang\u00b4s Ultimate Goal and Hacking Technologies<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"how_earth_krahang_influences_international_cyber_warfare\"\n                               onclick=handleScrollToTitle(\"how_earth_krahang_influences_international_cyber_warfare\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">How Earth Krahang Influences International Cyber Warfare<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"abusing_government_trust_and_reaping_chaos\"\n                               onclick=handleScrollToTitle(\"abusing_government_trust_and_reaping_chaos\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">Abusing Government Trust and Reaping Chaos<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                                                        <li class=\"StepProgress-item\">\n                                                <div class=\"StepProgress-item__group\">\n                            <a data-id=\"the_bottom_line\"\n                               onclick=handleScrollToTitle(\"the_bottom_line\")\n                               class=\"StepProgress-item__link\" data-level=\"2\">The Bottom Line<\/a>\n                                                    <\/div>\n                                                <\/li>\n                                    <\/ol>\n                <div class=\"toc-sticky__container__disperse\"><\/div>\n                <div class=\"toc-sticky__btn-top justify-content-center\">\n                    <button class=\"btn btn-link d-flex align-items-center\" onclick={btnTop()}><p>Show Full Guide<\/p><img decoding=\"async\"\n                                src=\"\/wp-content\/plugins\/table-of-contents\/assets\/images\/arrow-up-circle.svg\"\n                                alt=\"arrow-up-circle\">\n                    <\/button>\n                <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n    <div class=\"toc-sticky-list\">\n        <div class=\"toc-sticky__container container\">\n            <div class=\"toc-sticky__open d-flex align-items-end\" data-bs-toggle=\"collapse\" aria-controls=\"multiCollapse2\" data-bs-target=\"#multiCollapse2\">\n                <button class=\"btn btn-primary collapse-action-btn p-1 rounded-circle\"\n                        type=\"button\">\n                    <i class=\"icon-chevron-up up\"><\/i>\n                <\/button>\n                <span id=\"toc-current-title\" class=\"d-flex align-items-center\">\n                    Table of Contents\n                <\/span>\n            <\/div>\n            <div  class=\"collapse my-3\" id=\"multiCollapse2\">\n                <ol class=\"StepProgress\">\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item current \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"key_takeaways\"\n                                   onclick=handleScrollToTitle(\"key_takeaways\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Key Takeaways<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"experts_answer_who_is_earth_krahang\"\n                                   onclick=handleScrollToTitle(\"experts_answer_who_is_earth_krahang\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Experts Answer: Who is Earth Krahang?<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t                                                     <li class=\"StepProgress-item \">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"understanding_the_motives_behind_state-supported_hackers\"\n                                   onclick=handleScrollToTitle(\"understanding_the_motives_behind_state-supported_hackers\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Understanding the Motives Behind State-Supported Hackers<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t\n\t\t\t\t\t\t <span class=\"show_moretoc\">Show Full Guide<\/span>\n\t\t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"patriotism_entrapment_and_forced_cooperation\"\n                                   onclick=handleScrollToTitle(\"patriotism_entrapment_and_forced_cooperation\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Patriotism, Entrapment, and Forced Cooperation<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"earth_krahang_a_jack_of_all_trades\"\n                                   onclick=handleScrollToTitle(\"earth_krahang_a_jack_of_all_trades\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Earth Krahang: \u201cA Jack of All Trades\u201d<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"earth_krahangs_ultimate_goal_and_hacking_technologies\"\n                                   onclick=handleScrollToTitle(\"earth_krahangs_ultimate_goal_and_hacking_technologies\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Earth Krahang\u00b4s Ultimate Goal and Hacking Technologies<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"how_earth_krahang_influences_international_cyber_warfare\"\n                                   onclick=handleScrollToTitle(\"how_earth_krahang_influences_international_cyber_warfare\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">How Earth Krahang Influences International Cyber Warfare<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"abusing_government_trust_and_reaping_chaos\"\n                                   onclick=handleScrollToTitle(\"abusing_government_trust_and_reaping_chaos\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">Abusing Government Trust and Reaping Chaos<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                    \t\t\t\t\t \t\t\t\t\t \t\t\t\t\t\t  \t\t\t\t\t                                                      <li class=\"StepProgress-item ms_hidetoc\">\n                                                    <div class=\"StepProgress-item__group\">\n                                <a data-id=\"the_bottom_line\"\n                                   onclick=handleScrollToTitle(\"the_bottom_line\")\n                                   class=\"StepProgress-item__link\"\n                                   data-level=\"2\">The Bottom Line<\/a>\n                                                            <\/div>\n                                                    <\/li>\n                                    <\/ol>\n            <\/div>\n            <div class=\"toc-sticky__container__disperse\"><\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n<script id=\"toc-js\">\n    window.addEventListener(\"DOMContentLoaded\", () => {\n        const header = document.querySelector(\".header_wrapper\");\n\n        const pageLegend = document.querySelector('#multiCollapse1');\n        const pageLegendList = document.querySelector('#multiCollapse2');\n        const pageLegendCollapse = new bootstrap.Collapse(pageLegend, {toggle: document.querySelector(\".toc-sticky\").classList.contains('sticky')});\n\n        \/**\n         * Changing current title\n         *\/\n        (function (pageLegend) {\n            const titleNodes = pageLegend.querySelectorAll('.StepProgress-item__link');\n\n            if (!titleNodes.length) return;\n\n            const titles = [...titleNodes].map((itm, i) => ({\n                id: itm.getAttribute('data-id'),\n                text: itm.textContent,\n                level: itm.getAttribute('data-level'),\n                linkNode: itm,\n                titleNode: document.getElementById(itm.getAttribute('data-id')),\n                index: i,\n            }));\n\n            \/**\n             * Source: https:\/\/www.sitepoint.com\/throttle-scroll-events\/\n             * @param {Function} fn\n             * @param {number} wait\n             * @returns {(function(): void)|*}\n             *\/\n            const throttle = (fn, wait) => {\n                let time = Date.now();\n                return function () {\n                    if ((time + wait - Date.now()) < 0) {\n                        fn();\n                        time = Date.now();\n                    }\n                }\n            }\n\n            const changeCurrentTitle = () => {\n                const documentScrollTop = window.pageYOffset || document.documentElement.scrollTop || document.body.scrollTop || 0;\n                let current = 0;\n\n                \/\/ Title\n                titles.forEach((itm, i) => {\n\t\t\t\t\/\/console.log(itm)\n                    const itmOffsetTop = itm.titleNode ? itm.titleNode.offsetTop - 100 : 0;\n\n                    if (documentScrollTop >= itmOffsetTop) {\n                        document.getElementById('toc-current-title').innerHTML = itm.text;\n                        document.getElementById('toc-current-title').setAttribute('data-current-id', itm.id);\n                        document.getElementById('toc-current-title').setAttribute('data-current-level', itm.level);\n                        current = i;\n                    }\n                })\n\n                \/\/ close all list and open sub list if needed\n                if (document.querySelector(\".toc-sticky\").classList.contains('sticky')) {\n                    document.querySelectorAll('.subList-in-progress').forEach((el) => {\n                        el.children[1].classList.remove('show');\n                        el.getElementsByClassName('icon-chevron-down')[0].classList.remove('up');\n                    });\n                    const currentEl = titles[current];\n                    currentEl.linkNode.classList.add('show');\n                }\n\n                titles.forEach((itm, i) => {\n                    itm.linkNode.parentNode.parentNode.classList.remove('current', 'is-done');\n                    if (current > i) {\n                        itm.linkNode.parentNode.parentNode.classList.add('is-done')\n                    };\n                    if (current === i) {\n                      itm.linkNode.parentNode.parentNode.classList.add('current');\n                    };\n                })\n\n            }\n\n            changeCurrentTitle();\n\n            document.addEventListener('scroll', throttle(changeCurrentTitle, 50));\n        })(pageLegend);\n\n\n        \/**\n         *  Collapse\n         *\/\n        (function (pageLegend, header) {\n            const icon = pageLegend.parentNode.querySelector(\".collapse-action-btn i\");\n\n            const collapseToggle = (status) => (e) => {\n                if (!e.target.isEqualNode(pageLegend)) return;\n\n                icon.classList.toggle(\"up\");\n\n                const containerHeight = pageLegend.getBoundingClientRect().height;\n\n                const showSubtitleContent = () => {\n                    const currentId = document.getElementById('toc-current-title').getAttribute('data-current-id');\n                    const currentLevel = document.getElementById('toc-current-title').getAttribute('data-current-level');\n                    const currentSubTitle = currentLevel == 3 ? document.querySelector(`a[data-id=\"${currentId}\"]`).parentNode.parentNode.parentNode : false;\n\n                    if (!currentSubTitle) return;\n                    new bootstrap.Collapse(currentSubTitle, {toggle: false}).show();\n                }\n\n                showSubtitleContent();\n                if (status === 'shown' && document.querySelector(\".toc-sticky\").classList.contains('sticky') ) {\n                    document.querySelector('html').classList.remove('overflow-hidden');\n                    pageLegend.classList.add('overflow-auto');\n                    pageLegend.style.height = `calc(100vh - ${header.getBoundingClientRect().height + document.querySelector('.toc-sticky__open').getBoundingClientRect().height + 16}px)`;\n                } else if (status === 'hide') {\n                    document.querySelector('html').classList.remove('overflow-hidden');\n                    pageLegend.classList.remove('overflow-auto');\n                    pageLegend.style.height = 'auto';\n                }\n            }\n\n            pageLegend.addEventListener('shown.bs.collapse', collapseToggle('shown'));\n            pageLegend.addEventListener('hide.bs.collapse', collapseToggle('hide'));\n        })(pageLegend, header);\n\n        \/**\n         * Collapse sub-titles\n         *\/\n        (function (pageLegend) {\n            const collapseEls = pageLegend.querySelectorAll('.collapse');\n\n            collapseEls.forEach(function (el) {\n\n                const toggleArrowDirection = function (e) {\n                    if (!e.target.isEqualNode(el)) return;\n\n                    const id = this.getAttribute('id');\n                    document.querySelector(`.collapse-action-btn[data-bs-target=\"#${id}\"] .icon-chevron-down`).classList.toggle('up');\n                }\n                el.addEventListener('shown.bs.collapse', toggleArrowDirection);\n                el.addEventListener('hide.bs.collapse', toggleArrowDirection);\n            })\n        })(pageLegend);\n\n        \/**\n         *  Collapse main title\n         *\/\n        (function (pageLegendList) {\n            const icon = pageLegendList.parentNode.querySelector(\".collapse-action-btn i\");\n\n            const collapseToggle = () => (e) => {\n                if (!e.target.isEqualNode(pageLegendList)) return;\n\n                icon.classList.toggle(\"up\");\n\n            }\n            pageLegendList.addEventListener('shown.bs.collapse', collapseToggle());\n            pageLegendList.addEventListener('hide.bs.collapse', collapseToggle());\n        })(pageLegendList);\n\n        (function (pageLegendList) {\n            const collapseEls = pageLegendList.querySelectorAll('.collapse');\n\n            collapseEls.forEach(function (el) {\n\n                const toggleArrowDirection = function (e) {\n                    if (!e.target.isEqualNode(el)) return;\n\n                    const id = this.getAttribute('id');\n                    document.querySelector(`.toc-sticky-list .collapse-action-btn[data-bs-target=\"#${id}\"] .icon-chevron-down`).classList.toggle('up');\n                }\n                el.addEventListener('shown.bs.collapse', toggleArrowDirection);\n                el.addEventListener('hide.bs.collapse', toggleArrowDirection);\n            })\n        })(pageLegendList);\n\n        \/**\n         * Sticky functionality\n         * Source: https:\/\/stackoverflow.com\/questions\/17893771\/javascript-sticky-div-after-scroll\n         *\/\n        (function (header, pageLegendCollapse) {\n            \/\/ set everything outside the onscroll event (less work per scroll)\n            const target = document.querySelector(\".toc-sticky\");\n            const targetListStatic = document.querySelector(\".toc-sticky-list\");\n\n            if (!target || !header) return;\n\n            const headerHeight = header.getBoundingClientRect().height;\n            const targetHeight = targetListStatic.getBoundingClientRect().height;\n\n            \/\/ -headerHeight so it won't be jumpy\n            const stop = targetListStatic.offsetTop + headerHeight + targetHeight;\n            const docBody =\n                document.documentElement || document.body.parentNode || document.body;\n            const hasOffset = window.pageYOffset !== undefined;\n\n            const applySticky = function () {\n                \/\/ cross-browser compatible scrollTop.\n                const scrollTop = hasOffset ? window.pageYOffset : docBody.scrollTop;\n\n                \/\/ if user scrolls to headerHeight from the top of the target div\n                if (scrollTop >= stop) {\n                    pageLegendCollapse.hide();\n                    \/\/ stick the div\n                    target.classList.add(\"sticky\");\n                    \/\/target.style.marginTop = `${headerHeight}px`;\n                } else {\n                    pageLegendCollapse.show();\n                    \/\/ release the div\n                    target.classList.remove(\"sticky\");\n                    target.style.marginTop = \"\";\n                }\n            }\n\n            applySticky();\n\n            window.addEventListener('scroll', applySticky);\n        })(header, pageLegendCollapse);\n\tjQuery('span.show_moretoc').click(function(){\n\t\tjQuery('span.show_moretoc').hide();\n\t   jQuery('.ms_hidetoc').show();\n\t});\n    });\n\n    \/\/ When the user clicks on the button, scroll to the top of the document\n    function btnTop() {\n        const pageLegend = document.querySelector('#multiCollapse1');\n        document.querySelector('html').classList.remove('overflow-hidden');\n        pageLegend.classList.remove('overflow-auto');\n        pageLegend.style.height = 'auto';\n        window.scrollTo({\n            top: 0,\n            behavior: 'smooth'\n        });\n    }\n\n    const handleScrollToTitle = (id) => {\n        const el = document.getElementById(id);\n        const headerHeightDifference = window.innerWidth < 992 ? -30 : -15;\n        window.scrollTo({\n            top: el.offsetTop - 60 - headerHeightDifference - 10,\n        });\n    }\n<\/script>\n\n<h2><span id=\"experts_answer_who_is_earth_krahang\">Experts Answer: Who is Earth Krahang?<\/span><\/h2>\n<p>On March 18, 2024, <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/c\/earth-krahang.html\" target=\"_blank\">Trend Micro<\/a> released a report with the findings of an investigation that began in 2022. Trend Micro found that the hacking group Earth Krahang was exploiting intergovernmental trust to launch cross-government attacks.<\/p>\n<p>Earth Karang leverages vulnerabilities in public-facing services and uses <a href=\"https:\/\/www.techopedia.com\/definition\/4121\/spear-phishing\">spear-phishing<\/a> emails to drop previously unseen backdoors on victims \u0301 systems. Researchers also found evidence that links Earth Karang to another Chine-nexus threat actor known as Earth Lusca as well as to the Chinese penetration testing company I-Soon.<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/ashleyyvonne\/\" target=\"_blank\">Ashley-Yvonne Howard<\/a>, Senior Cloud Security Strategist at <a href=\"https:\/\/panther.com\/\" target=\"_blank\">Panther Labs<\/a> \u2014\u00a0 a modern security information and event management (SIEM) platform for the cloud \u2014- talked to Techopedia about the group.<\/p>\n<blockquote><p>\u201cEarth Krahang is a previously unidentified Chinese espionage group that successfully breached at least 70 organizations in 23 countries and targeted at least 116 across 45 countries.\u201d<\/p>\n<p>&nbsp;<\/p>\n<p>\u201cIncluded in the confirmed breached organizations are 48 in the government space. Other victims are from education, telecommunications, finance, IT, and more sectors.\u201d<\/p><\/blockquote>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/irina-tsukerman-4b04595\/\" target=\"_blank\">Irina Tsukerman<\/a> \u2014 U.S. national security lawyer and President of <a href=\"https:\/\/scarabrising.com\/\" target=\"_blank\">Scarab Rising, Inc.<\/a>, a security and geopolitical risk strategic advisory \u2014 also linked Earth Krahang with China and explained the synergy between the group and the People&#8217;s Republic of China (PRC).<\/p>\n<blockquote><p>\u201cEarth Krahang is a type of cyber intrusion-penetration campaign that targets international government entities-actors. It is likely linked to the Chinese company I-Soon.\u201d<\/p><\/blockquote>\n<p>Tsukerman explained that the nature of I-Soon was recently exposed in a massive leak online, and Malwarebytes speculated that while the <a href=\"https:\/\/www.malwarebytes.com\/blog\/news\/2024\/02\/a-first-analysis-of-the-i-soon-data-leak\" target=\"_blank\">origin of the I-Soon leak of February 2024 is uncertain<\/a>, one possible explanation is a disgruntled I-Soon inside man.<\/p>\n<p>Data from the leak include hacking tools and resources, evidence that links I-Soon as a private contractor that operates as an <a href=\"https:\/\/www.techopedia.com\/definition\/28118\/advanced-persistent-threat-apt\">Advanced Persistent Threat<\/a> (APT)-for-hire (operating for China\u2019s Ministry of Public Security).<\/p>\n<p>According to the leaked data, i-Soon infiltrated several government departments, including those from India, Thailand, Vietnam, South Korea, and NATO.<\/p>\n<p>Tsukerman added:<\/p>\n<blockquote><p>\u201cThis type of threat actor acts as a private entity and may have distinct goals and interests but engages in sophisticated methods to the benefit of a state actor.<\/p><\/blockquote>\n<p>\u201cI-Soon was responsible for developing the &#8216;commercial&#8217; spyware and other tools that were, in fact, being used by APTs to carry out missions and operations that ultimately benefited the government agenda. The PRC uses third-party entities to obscure its role in international intelligence operations.\u201d<\/p>\n<h2><span id=\"understanding_the_motives_behind_state-supported_hackers\">Understanding the Motives Behind State-Supported Hackers<\/span><\/h2>\n<p>In the underground world of cybercriminals and bad actors, illegally obtained financial gains tend to be the main motivating force behind attacks. However, as geopolitical tensions increase around the world due to political and commercial differences, and fueled by armed conflicts such as the ongoing Russian invasion of Ukraine, and the Hamas-Israel war, nation-state-supported hackers are becoming every day more politically driven.<\/p>\n<p>Tsukerman spoke about the complex relationships that hackers belonging to groups like Earth Krahang have with the government of China.<\/p>\n<h2><span id=\"patriotism_entrapment_and_forced_cooperation\">Patriotism, Entrapment, and Forced Cooperation<\/span><\/h2>\n<p>According to Tsukerman many threat actors like Earth Krahang appear to be private hackers motivated by PRC&#8217;s call to duty \u2014 patriotism.<\/p>\n<blockquote><p>\u201cMore often than not, there is a tacit understanding between the cyber-criminals and the government that they continue their enrichment and private acts of hacking outside their own country without legal repercussions so long as they provide informal assistance to the government in meeting their needs.\u201d<\/p><\/blockquote>\n<p>But Tsukerman added that the level of cooperation and government support these groups get varies from hacker group to hacker group.<\/p>\n<blockquote><p>\u201cIt may range from voluntary and engaged cooperation to reluctant or forced operations from hackers who had been caught or entrapped and compelled to carry out intelligence operations to avoid prison.\u201d<\/p><\/blockquote>\n<h2><span id=\"earth_krahang_a_jack_of_all_trades\">Earth Krahang: \u201cA Jack of All Trades\u201d<\/span><\/h2>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/jmcquiggan\" target=\"_blank\">James McQuiggan<\/a>, Security Awareness Advocate at <a href=\"http:\/\/www.knowbe4.com\" target=\"_blank\">KnowBe4<\/a> \u2014\u00a0 a security awareness training and simulated phishing platform \u2014 spoke to Techopedia about what pushes Earth Krahang to launch cyberattacks and cyberespionage operations.<\/p>\n<blockquote><p>\u201cAPT groups like Earth Krahang are motivated by various reasons, including economic, geopolitical, and strategic interests. These motivations drive the group to target government entities, with the ultimate goal of advancing the interests of their sponsoring state.&#8221;<\/p>\n<p>&nbsp;<\/p>\n<p>&#8220;They are a jack of all trades and leverage various attack vectors to help their cause. Spear phishing targets specific groups of people and socially engineers them to gain access to the organization or government entity.\u201d<\/p><\/blockquote>\n<p>McQuiggan added that the group also leverages already-established access to government websites or emails. Then, the group emails government contacts with malicious URLs. Using known and trusted emails to increase the opportunity they trick victims into installing malware.<\/p>\n<h2><span id=\"earth_krahangs_ultimate_goal_and_hacking_technologies\">Earth Krahang\u00b4s Ultimate Goal and Hacking Technologies<\/span><\/h2>\n<p>Howard from Panther Labs had a clear answer to the question of what motivates Earth Krahang.<\/p>\n<blockquote><p>\u201cThe ultimate motivation of this group is cyberespionage\u201d<\/p><\/blockquote>\n<p>Like other international cybercriminal groups, Earth Krahang&#8217;s preferred vector of attack is phishing. By establishing trust through the use of trusted email addresses, the groups operate by tricking workers and getting easy access by stealing credentials and dropping malicious payloads and backdoors.<\/p>\n<p>Malware Bytes explained that government organizations seem to be Earth Krahang\u2019s primary targets, with 48 government organizations being compromised and a further 49 other government entities being targeted. Within government organizations, Foreign Affairs Ministers are the most attacked by the group.<\/p>\n<p>Digital forensics analysis reveals that Earth Krahang used Cobalt Strike and two custom backdoors, RESHELL, .NET, and XDealer \u2014 all simple backdoors with basic capabilities that allow bad actors to extract data, drop files on infected systems, execute remote system commands, and more.<\/p>\n<p>In 2023, the group evolved and began using the <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2022\/pdf\/JSAC2022_7_leon-niwa-ishimaru_en.pdf\" target=\"_blank\">XDealer<\/a> backdoor, which compared to RESHELL, gives hackers more comprehensive backdoor capabilities.<\/p>\n<p>Howard dove further into the techniques that Earth Krahang utilizes for its operations.<\/p>\n<blockquote><p>\u201cThey aren\u2019t super sophisticated. They abuse this infrastructure to host malicious payloads, proxy attack traffic, and send spear-phishing emails via compromised government email accounts.\u201d<\/p><\/blockquote>\n<p>Howard added that the group also deploys tactics such as setting up <a href=\"https:\/\/www.techopedia.com\/definition\/30750\/vpn-server\">VPN servers<\/a> on compromised public-facing servers to infiltrate victims&#8217; private networks and conducting brute-force attacks to obtain email credentials, enabling them to exfiltrate victim emails.<\/p>\n<h3>False Flag Operations<\/h3>\n<p>As the veil is withdrawn, exposing China\u00b4s support and collaboration with threat actors,\u00a0 Tsukerman from Scarab Rising Inc. spoke about Earth Krahang activities and technologies.<\/p>\n<blockquote><p>\u201cIn intelligence parlor, their activity can to some extent fit into a category of\u00a0 &#8216;false flag operations&#8217;\u201d.<\/p><\/blockquote>\n<p>A false flag operation is a covert maneuver where an action is performed to appear as if it was done by another party. This is done to mislead people and shift the blame.<\/p>\n<blockquote><p>\u201cSome of their operations involve its malicious access to government infrastructure to attack other government entities, abusing the infrastructure to host malicious payloads, proxy attack traffic, and send spear-phishing emails to government-related targets using compromised government email accounts.\u201d<\/p><\/blockquote>\n<p>Tsukerman also said the group builds VPN servers on compromised public-facing servers to establish access into the private network of victims and perform brute-force attacks to obtain email credentials.<\/p>\n<blockquote><p>\u201cThese credentials are then used to exfiltrate victim emails, with the group\u2019s ultimate goal being cyber espionage.\u201d<\/p><\/blockquote>\n<h3>Git and Idea Files, and Brute Force Techniques<\/h3>\n<p>Speaking about the technology the group uses, Tsukerman listed open-source scanning tools that perform recursive searches of folders such as .git or .idea files.<\/p>\n<p>While Git and .idea files do not directly contain sensitive information themselves, Git and .idea files can be valuable for cyber espionage in different ways.<\/p>\n<p>Git tracks changes made to code over time. An attacker could use this history to understand the project&#8217;s development process, identify vulnerabilities introduced in earlier versions, see what features are being worked on, and potentially steal unreleased code.<\/p>\n<p>Git files can also reveal the project&#8217;s organization and focus. Attackers might learn about planned features, internal discussions reflected in branch names, or identify deployment schedules. In rare cases, developers might accidentally commit sensitive credentials (passwords, API keys) into the Git repository. These can be disastrous if accessed by attackers.<\/p>\n<p>In contrast, .idea files are specific to JetBrains IDEs (like IntelliJ IDEA) and store project configurations. While not directly containing sensitive data, they could reveal libraries and frameworks used in the project, potentially leading to vulnerability discovery. These files can also host code formatting preferences data, which can be a minor indicator of the development team&#8217;s origin (though not very reliable).<\/p>\n<p>\u201cThe threat actor also resorts to simply brute-forcing directories to help identify files that may contain sensitive information such as file paths or passwords on the victim\u2019s servers,\u201d Tsukerman said.<\/p>\n<p>Other techniques and technologies that Earth Krahang uses, highlighted by Tsukerman include: the examination of the subdomains of their targets to find interesting and possible unmaintained servers, vulnerability scanning with tools like sqlmap, nuclei, xray, vscan, pocsuite, and wordpressscan to find web server weak points that allow them to access the server, drop web shells, and install backdoors.<\/p>\n<p>\u201cIn terms of open-source tools, those are not particularly complicated and less likely to lead to the detection of a specific APT, \u201d Tsukerman said and added that backdoor filenames of Earth Krahang are usually related to geopolitical topics, indicating their preferred type of lure.<\/p>\n<h2><span id=\"how_earth_krahang_influences_international_cyber_warfare\">How Earth Krahang Influences International Cyber Warfare<\/span><\/h2>\n<p>Techopedia asked experts how Earth Krahang&#8217;s actions are impacting the current state of cyber warfare.<\/p>\n<p>Howard from Panther Labs said the group is definitely leaving a mark. \u201cMore than half of the organizations they attacked across 23 countries are part of the government,\u201d Howard said.<\/p>\n<blockquote><p>\u201cThis signifies a major need to find a more unified approach when it comes to cybersecurity because the group doesn\u2019t seem to have a preference on which country to breach. How we help unify is by keeping up with employee training so employees can better spot phishing emails.\u201d<\/p><\/blockquote>\n<h2><span id=\"abusing_government_trust_and_reaping_chaos\">Abusing Government Trust and Reaping Chaos<\/span><\/h2>\n<p>For Tsukerman the element of a &#8220;false-flag operation&#8221; is vital as it is used to misdirect suspicion towards a friendly government.<\/p>\n<blockquote><p>\u201cAnd by weaponizing intergovernmental trust, (Earth Krahang) compromise diplomatic or security relations as much as the servers or mailboxes of the respective agencies.<\/p>\n<p>&nbsp;<\/p>\n<p>\u201cThe presence of Earth Krahang adds an element of chaos to the cyber warfare environment by masking the trail and diverting attention from the specific types of tools and the combination of methods that could point to the I-Soon linked origin of the threat.\u201d<\/p><\/blockquote>\n<p>As Tsukerman explains, it is not uncommon for adversarial foreign intelligence agencies to use various methods not only to disguise their own trail but to use imitation spyware to misdirect the investigation elsewhere, including towards another government or company, with the hope of wreaking havoc in relations as well as gathering intelligence.<\/p>\n<p>\u201cEven casting a temporary shadow of suspicion and complicating the international cyberwarfare landscape is enough of a success,\u201d Tsukerman said.<\/p>\n<p>As Earth Krahang and its ilk become more sophisticated Tsukerman said these groups are more likely to use their tools as frequently to start espionage or smear campaigns against governments and companies and to disrupt relations and intelligence cooperation.<\/p>\n<h2><span id=\"the_bottom_line\">The Bottom Line<\/span><\/h2>\n<p>The actions of Earth Krahang have a profound impact on cyber warfare and add further tensions and pressure on U.Sx., European, and other countries&#8217; relationships with China.<\/p>\n<p>China is now facing strong criticism, possible criminal charges, and sanctions from different countries that are responding to evidence that China is heavily involved in malicious cyber operations and cyber espionage around the world.<\/p>\n<p>Once again, geopolitical differences are spilling over into the digital world at an alarming rate and escalation pace, impacting millions of people and governments around the world. The Chinese-supported cyber actions are a reflection of the state of global politics and global cyber warfare and are only expected to continue manifesting themselves in the near future.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Chinese hacking saga against the U.S. and the U.K. continues to heat up. Targeted countries have set new criminal charges and sanctions against the hacking group APT31 \u2014 allegedly running cyber espionage attacks on behalf of China\u2019s civilian intelligence agency. However, security experts warn that another threat actor known as Earth Krahang, also allegedly [&hellip;]<\/p>\n","protected":false},"author":286688,"featured_media":211099,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_lmt_disableupdate":"no","_lmt_disable":"","om_disable_all_campaigns":false,"footnotes":""},"categories":[548],"tags":[],"category_partsoff":[],"class_list":["post-211060","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.2 (Yoast SEO v24.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How &#039;Earth Krahang&#039; Breached 48 Governments Across the World Techopedia<\/title>\n<meta name=\"description\" content=\"Learn from experts and Techopedia research and analysis about the alleged Chinese-supported group Earth Krahang and how they operate.\" \/>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How &#039;Earth Krahang&#039; Breached 48 Governments Across the World: Expert Analysis\" \/>\n<meta property=\"og:description\" content=\"Learn from experts and Techopedia research and analysis about the alleged Chinese-supported group Earth Krahang and how they operate.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world\" \/>\n<meta property=\"og:site_name\" content=\"Techopedia\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/techopedia\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-28T09:01:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ray Fernandez\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@techopedia\" \/>\n<meta name=\"twitter:site\" content=\"@techopedia\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ray Fernandez\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world\"},\"author\":{\"name\":\"Ray Fernandez\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c\"},\"headline\":\"How &#8216;Earth Krahang&#8217; Breached 48 Governments Across the World: Expert Analysis\",\"datePublished\":\"2024-03-28T09:01:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world\"},\"wordCount\":2195,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg\",\"articleSection\":\"\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#respond\"]}],\"copyrightYear\":\"2024\",\"copyrightHolder\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world\",\"url\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world\",\"name\":\"How 'Earth Krahang' Breached 48 Governments Across the World Techopedia\",\"isPartOf\":{\"@id\":\"https:\/\/www.techopedia.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg\",\"datePublished\":\"2024-03-28T09:01:19+00:00\",\"description\":\"Learn from experts and Techopedia research and analysis about the alleged Chinese-supported group Earth Krahang and how they operate.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg\",\"width\":1200,\"height\":600,\"caption\":\"How 'Earth Krahang' Breached 48 Governments Across the World\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.techopedia.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity\",\"item\":\"https:\/\/www.techopedia.com\/topic\/4\/cybersecurity\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How &#8216;Earth Krahang&#8217; Breached 48 Governments Across the World: Expert Analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.techopedia.com\/#website\",\"url\":\"https:\/\/www.techopedia.com\/\",\"name\":\"Techopedia\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.techopedia.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.techopedia.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.techopedia.com\/#organization\",\"name\":\"Techopedia\",\"url\":\"https:\/\/www.techopedia.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg\",\"caption\":\"Techopedia\"},\"image\":{\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/techopedia\/\",\"https:\/\/x.com\/techopedia\",\"https:\/\/www.linkedin.com\/company\/techopedia\/\",\"https:\/\/www.youtube.com\/c\/Techopedia\"],\"publishingPrinciples\":\"https:\/\/www.techopedia.com\/about\/editorial-policy\",\"ownershipFundingInfo\":\"https:\/\/www.techopedia.com\/about\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c\",\"name\":\"Ray Fernandez\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.techopedia.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg\",\"contentUrl\":\"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg\",\"caption\":\"Ray Fernandez\"},\"description\":\"Ray is an independent journalist with 15 years of experience, focusing on the intersection of technology with various aspects of life and society. He joined Techopedia in 2023 after publishing in numerous media, including Microsoft, TechRepublic, Moonlock, Hackermoon, VentureBeat, Entrepreneur, and ServerWatch. He holds a degree in Journalism from Oxford Distance Learning and two specializations from FUNIBER in Environmental Science and Oceanography. When Ray is not working, you can find him making music, playing sports, and traveling with his wife and three kids.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/ray-fernandez\/\"],\"knowsAbout\":[\"Senior Technology Journalist\"],\"url\":\"https:\/\/www.techopedia.com\/contributors\/rayfernandez\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How 'Earth Krahang' Breached 48 Governments Across the World Techopedia","description":"Learn from experts and Techopedia research and analysis about the alleged Chinese-supported group Earth Krahang and how they operate.","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"How 'Earth Krahang' Breached 48 Governments Across the World: Expert Analysis","og_description":"Learn from experts and Techopedia research and analysis about the alleged Chinese-supported group Earth Krahang and how they operate.","og_url":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world","og_site_name":"Techopedia","article_publisher":"https:\/\/www.facebook.com\/techopedia\/","article_published_time":"2024-03-28T09:01:19+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg","type":"image\/jpeg"}],"author":"Ray Fernandez","twitter_card":"summary_large_image","twitter_creator":"@techopedia","twitter_site":"@techopedia","twitter_misc":{"Written by":"Ray Fernandez","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#article","isPartOf":{"@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world"},"author":{"name":"Ray Fernandez","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c"},"headline":"How &#8216;Earth Krahang&#8217; Breached 48 Governments Across the World: Expert Analysis","datePublished":"2024-03-28T09:01:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world"},"wordCount":2195,"commentCount":0,"publisher":{"@id":"https:\/\/www.techopedia.com\/#organization"},"image":{"@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage"},"thumbnailUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg","articleSection":"","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#respond"]}],"copyrightYear":"2024","copyrightHolder":{"@id":"https:\/\/www.techopedia.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world","url":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world","name":"How 'Earth Krahang' Breached 48 Governments Across the World Techopedia","isPartOf":{"@id":"https:\/\/www.techopedia.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage"},"image":{"@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage"},"thumbnailUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg","datePublished":"2024-03-28T09:01:19+00:00","description":"Learn from experts and Techopedia research and analysis about the alleged Chinese-supported group Earth Krahang and how they operate.","breadcrumb":{"@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#primaryimage","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2024\/03\/lock_02.jpg","width":1200,"height":600,"caption":"How 'Earth Krahang' Breached 48 Governments Across the World"},{"@type":"BreadcrumbList","@id":"https:\/\/www.techopedia.com\/how-earth-krahang-breached-48-governments-across-the-world#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.techopedia.com\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity","item":"https:\/\/www.techopedia.com\/topic\/4\/cybersecurity"},{"@type":"ListItem","position":3,"name":"How &#8216;Earth Krahang&#8217; Breached 48 Governments Across the World: Expert Analysis"}]},{"@type":"WebSite","@id":"https:\/\/www.techopedia.com\/#website","url":"https:\/\/www.techopedia.com\/","name":"Techopedia","description":"","publisher":{"@id":"https:\/\/www.techopedia.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.techopedia.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.techopedia.com\/#organization","name":"Techopedia","url":"https:\/\/www.techopedia.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2025\/02\/techopedia-light-logo.svg","caption":"Techopedia"},"image":{"@id":"https:\/\/www.techopedia.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/techopedia\/","https:\/\/x.com\/techopedia","https:\/\/www.linkedin.com\/company\/techopedia\/","https:\/\/www.youtube.com\/c\/Techopedia"],"publishingPrinciples":"https:\/\/www.techopedia.com\/about\/editorial-policy","ownershipFundingInfo":"https:\/\/www.techopedia.com\/about"},{"@type":"Person","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/687890072e5e44867899acd7d6176e6c","name":"Ray Fernandez","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.techopedia.com\/#\/schema\/person\/image\/","url":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg","contentUrl":"https:\/\/www.techopedia.com\/wp-content\/uploads\/2023\/10\/avatar_user_286688_1698354675-300x300.jpg","caption":"Ray Fernandez"},"description":"Ray is an independent journalist with 15 years of experience, focusing on the intersection of technology with various aspects of life and society. He joined Techopedia in 2023 after publishing in numerous media, including Microsoft, TechRepublic, Moonlock, Hackermoon, VentureBeat, Entrepreneur, and ServerWatch. He holds a degree in Journalism from Oxford Distance Learning and two specializations from FUNIBER in Environmental Science and Oceanography. When Ray is not working, you can find him making music, playing sports, and traveling with his wife and three kids.","sameAs":["https:\/\/www.linkedin.com\/in\/ray-fernandez\/"],"knowsAbout":["Senior Technology Journalist"],"url":"https:\/\/www.techopedia.com\/contributors\/rayfernandez"}]}},"modified_by":"arina livanenkova","_links":{"self":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts\/211060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/users\/286688"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/comments?post=211060"}],"version-history":[{"count":0,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/posts\/211060\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/media\/211099"}],"wp:attachment":[{"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/media?parent=211060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/categories?post=211060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/tags?post=211060"},{"taxonomy":"category_partsoff","embeddable":true,"href":"https:\/\/www.techopedia.com\/wp-json\/wp\/v2\/category_partsoff?post=211060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}