6 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
The article discusses the "Premier Pass-as-a-Service" model, highlighting the collaboration between China-aligned APT groups Earth Estries and Earth Naga. This partnership complicates detection and attribution of cyberattacks, as the two groups share access to compromised assets, targeting critical sectors across various regions.
If you do, here's more
The piece examines the emerging "Premier Pass-as-a-Service" model, highlighting a trend where China-aligned advanced persistent threat (APT) groups, specifically Earth Estries and Earth Naga, collaborate on cyberespionage campaigns. Earth Estries has acted as an access broker for Earth Naga, facilitating shared access to compromised assets. This cooperation complicates detection and attribution of cyberattacks, as multiple intrusion sets are involved in a single operation.
The report details specific targeting by these groups, noting Earth Estries' focus on critical sectors like telecommunications and government agencies across the US, Asia-Pacific, and the Middle East. Earth Naga has similarly targeted high-value organizations, including military and technology firms, with a significant emphasis on Taiwanese entities. The collaborative efforts have led to incidents in various regions, including a notable retail company in APAC in November 2024 and a government agency in Southeast Asia in March 2025.
Trendβ’ Research introduces a four-tier framework for categorizing these collaborative attacks, aiming to assist cybersecurity professionals in understanding the complexities of these inter-group relationships. The challenges of attribution are emphasized, as traditional methods struggle with the intricacies of shared operations. Evidence suggests that Earth Estries has provided access to Earth Naga in at least two documented cases, indicating a strategic alliance that could reshape how cyber threat intelligence is approached in the future.
Questions about this article
No questions yet.