Earth Lamia: Inside China’s Multi-Vector Cyber Campaign Targeting Critical Infrastructure 🎯

How a sophisticated threat actor turned vulnerability hunting into an art form

The cybersecurity landscape witnessed another sophisticated campaign this month when researchers uncovered Earth Lamia, a China-linked Advanced Persistent Threat (APT) group that has been systematically targeting organizations across Asia and Brazil since 2023. What makes this group particularly dangerous isn’t just their technical prowess, but their methodical approach to vulnerability exploitation and their ability to adapt their tactics based on shifting geopolitical interests. 🌏

The Scope of Operations 📊

Earth Lamia’s operations span multiple continents, with confirmed attacks across:

• Brazil 🇧🇷
• India 🇮🇳
• Southeast Asia (Indonesia, Malaysia, Philippines, Thailand, Vietnam)

The group has demonstrated remarkable persistence, conducting sustained campaigns that reveal a well-resourced operation with clear strategic objectives.

Technical Deep Dive: The Vulnerability Arsenal 🔧

Primary Attack Vector: SQL Injection Mastery