JSAC2026 Day 1: China-nexus APT campaigns detailed
JPCERT/CC's JSAC2026 conference detailed multiple China- and North Korea-linked APT campaigns, including Earth Krahang, Earth Kurma, Tianwu, and Konni, plus mass Ivanti exploitation.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-55182 as exploited in the wild.
JPCERT/CC's JSAC2026 conference (Jan 21-23, 2026) featured presentations from Trend Micro, Palo Alto Networks, Cisco Talos, TeamT5, Cycraft, IIJ, LAC, and ITOCHU covering a broad range of nation-state intrusion activity. Highlights included the PONDSNAKE and WILYCODE campaigns linked to Earth Krahang and Earth Lusca (both associated with the leaked Chinese contractor i-Soon), targeting government, financial, education, and healthcare organizations via public-facing server exploitation and spear-phishing, deploying tools such as SnakeC2, NEOBEACON, Cobalt Strike, and VShell. Palo Alto Networks presented a multi-cluster attribution case study involving CL-STA-1048 (possible Earth Estries links), CL-STA-1049 (attributed to Unfading Sea Haze), and a Stately Taurus cluster, illustrating the challenges of overlapping Chinese APT toolsets under a 'Premier Pass-as-a-Service' collaboration model.
Additional sessions detailed Earth Kurma's stealthy persistence and exfiltration techniques abusing OneDrive, Dropbox, and Webex against Southeast Asian government and telecom targets; the continued evolution of Tianwu's Pangolin8RAT and custom Cobalt Strike Beacon since 2022 with intensified activity from October 2024; and a Cycraft-analyzed Chinese state-sponsored intrusion against Taiwanese government and manufacturing sectors using Microsoft Graph API C2 laundering, dead-drop resolvers, and AD logon script abuse for malware distribution (GRAPHBROTLI, GRAPHRELOOK, RCREMARK). LAC researchers detailed GSRAT, an AutoIt-based RAT tied to North Korea's Konni group, used in spear-phishing against Korean financial-sector affiliates.
Separately, TeamT5 reported large-scale exploitation of Ivanti Connect Secure devices — over 170 compromised systems across 25 regions concentrated in Japan, Taiwan, South Korea, and the US — involving the SPAWN malware suite, the TextDoor in-memory backdoor, and DebtTheft credential theft, alongside forensic challenges from encrypted partitions and GUI-limited logging. A Tropic Trooper-attributed case demonstrated a DNS-hijacking supply-chain-style attack in which a compromised home router redirected legitimate application updates to a malicious server, underscoring risks in trusted update mechanisms.
Mentioned in this report
Detection guidance
Registry Run Key Modification for Persistence
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects modification of Windows Registry Run keys to establish malware persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Registry Run Key Modification for Persistence
description: Detects modifications to Registry Run/RunOnce keys (HKLM/HKCU) commonly
used by APT groups for malware auto-start persistence. Consistent with persistence
techniques in PONDSNAKE, WILYCODE, and AD logon script abuse patterns.
tags:
- attack.persistence
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
filter_windows_components:
Details|contains:
- C:\Program Files
- C:\Program Files (x86)
- C:\Windows\System32
condition: selection and not filter_windows_components
falsepositives:
- Third-party application installers registering legitimate startup entries
- System administration tools configuring auto-start applications
level: medium
id: b40ea48c-6df9-5950-8cbe-5cabb4706d30
status: experimental
author: Vorant
Cloud Storage Service Abuse for Data Exfiltration
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious outbound connections to cloud storage services indicative of data exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cloud Storage Service Abuse for Data Exfiltration
description: Detects network connections to OneDrive, Dropbox, and Webex endpoints
from suspicious processes, consistent with Earth Kurma and other Chinese APT exfiltration
techniques abusing legitimate cloud services as dead-drop or C2 infrastructure.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains:
- onedrive.com
- dropbox.com
- webex.com
- graph.microsoft.com
Image|endswith:
- \cmd.exe
- \powershell.exe
- \curl.exe
- \wget.exe
DestinationPort: 443
filter_outlook_teams:
Image|endswith:
- \OUTLOOK.EXE
- \Teams.exe
condition: selection and not filter_outlook_teams
falsepositives:
- Legitimate user backup and sync software (OneDrive, Dropbox clients)
- IT administrators using cloud services for data transfers
- Microsoft Teams and Outlook legitimate cloud service connections
level: medium
id: 905135f5-bd13-5b2d-b60f-a44dadd4055c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2026/02/jsac2026day1.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs