Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionageAdvanced sophistication · Unknown

Earth Alux

Earth Alux is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 5 sectors, including Government and Technology, in 5 countries, including Brazil and Taiwan. It uses 22 MITRE ATT&CK techniques.

Also known as
  • Jewelbug
  • CL-STA-0049
  • REF7707
  • Ink Dragon
Request IOC feedRequest ATT&CK export
Origin
China
Techniques
22
Exploited CVEs
No CVE data
First seen
Jan 1, 2023
Last seen
Mar 31, 2025
Record updated

Who They Target.

Sectors · 5
Countries · 5
Labelsbd:governance:curation:analyst-reviewedcyberespionagedata-exfiltration

About Earth Alux.

First sighted in Q2 2023, Earth Alux has targeted government, technology, logistics, manufacturing, telecommunications, IT services, and retail organizations in Asia-Pacific and later Latin America. The group exploits vulnerable exposed services, deploys GODZILLA web shells and VARGEIT and COBEACON backdoors, and uses RAILLOAD and RAILSETTER for later-stage loading, persistence, and defense evasion.

Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.