Earth Baxia
Earth Baxia is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Government, and Energy and Utilities, in 6 countries, including China and Taiwan. It uses 9 MITRE ATT&CK techniques and exploits 1 known CVE.
- Origin
- China
- Techniques
- 9
- Exploited CVEs
- 1
- First seen
- Jun 21, 2024
- Last seen
- Aug 15, 2024
- Record updated
Who They Target.
Labelsbd:governance:curation:analyst-reviewed
About Earth Baxia.
The reported activity used spear-phishing and GeoServer exploitation to deploy customized Cobalt Strike and the EAGLEDOOR backdoor, then exfiltrated collected data. The China-origin assessment remains a claim rather than a confirmed location attribution.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.