Earth Longzhi
Earth Longzhi is a China-attributed threat actor group with an ideological motive, tracked by Brandefense. It uses 1 MITRE ATT&CK technique.
- Origin
- China
- Techniques
- 1
- Exploited CVEs
- No CVE data
- First seen
- Nov 7, 2025
- Last seen
- Nov 7, 2025
- Record updated
About Earth Longzhi.
A subgroup of 'APT 41'. The malware used in the incident was a simple but custom Cobalt Strike loader. After further investigation, however, we found incidents targeting multiple regions using a similar Cobalt Strike loader. While analyzing code similarities and tactics, techniques, and procedures (TTPs), we discovered that the actor behind this attack has been active since 2020. After clustering each intrusion, we concluded that the threat actor is a new subgroup of advanced persistent threat (APT) group APT41 that we call Earth Longzhi.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.