Earth Minotaur

Reports per quarter

Techniques seen in the last two years

• T1027.007 1 report
• T1027.009 1 report
• T1027.014 1 report
• T1055 1 report
• T1055.004 1 report
• T1059.003 1 report
• T1082 1 report
• T1095 1 report
• T1105 1 report
• T1106 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2020-16040

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 26 January 2026

   PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

2. 30 April 2025

   TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

3. 5 December 2024

   MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

Newest first. Details opens the report in Explore.