Earth Lamia

Reports per quarter

Techniques seen in the last two years

• T1140 2 reports
• T1574.001 2 reports
• T1595.002 2 reports
• T1003.001 1 report
• T1003.002 1 report
• T1005 1 report
• T1008 1 report
• T1027 1 report
• T1027.007 1 report
• T1027.013 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2024-1709 KEV ransomware
• CVE-2025-1338
• CVE-2025-31324 KEV ransomware
• CVE-2025-55182 KEV ransomware
• CVE-2025-55183
• CVE-2025-55184
• CVE-2025-66478
• CVE-2025-67779

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 19 December 2025

   Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

2. 12 December 2025

   Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)

3. 4 December 2025

   China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web Services

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web Services

4. 6 June 2025

   Operation DRAGONCLONE: Chinese Telecommunication industry targeted via VELETRIX & VShell malware

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Operation DRAGONCLONE: Chinese Telecommunication industry targeted via VELETRIX & VShell malware

5. 27 May 2025

   Earth Lamia Develops Custom Arsenal to Target Multiple Industries

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Newest first. Details opens the report in Explore.