A new China-linked threat actor, Earth Alux, has emerged as a sophisticated cyberespionage group targeting key sectors across the Asia-Pacific (APAC) and Latin American (LATAM) regions. Researchers have documented Earth Alux’s activities, noting its presence since the second quarter of 2023, primarily in APAC, and its expansion into Latin America by mid-2024. The group targets countries including Thailand, the Philippines, Malaysia, Taiwan, and Brazil, focusing on sectors such as government, technology, logistics, manufacturing, telecommunications, IT services, and retail. Earth Alux initiates attacks by exploiting vulnerabilities in internet-exposed web applications, deploying the Godzilla web shell to facilitate further payload deployment. Key payloads include backdoors named VARGEIT and COBEACON (also known as Cobalt Strike Beacon). VARGEIT functions to load tools directly from its command-and-control (C&C) server, utilizing Microsoft Paint processes for reconnaissance and data exfiltration. It also supports tasks like lateral movement and network discovery in a fileless manner. COBEACON acts as a first-stage backdoor, launched via MASQLOADER or RSBINJECT, a Rust-based shellcode loader. MASQLOADER incorporates anti-API hooking techniques to evade detection by security programs, allowing malware to operate stealthily. VARGEIT deploys additional tools, including RAILLOAD, which uses DLL side-loading to run encrypted payloads, and RAILSETTER, a module that alters timestamps and creates scheduled tasks for persistence. VARGEIT supports ten (10) different C&C communication channels, including HTTP, TCP, UDP, ICMP, DNS, and Microsoft Outlook, utilizing the Graph API for command exchanges via the drafts folder of an attacker-controlled mailbox. Earth Alux conducts detection tests with RAILLOAD and RAILSETTER and seeks new hosts for DLL side-loading. Tools like ZeroEye and VirTest, popular in the Chinese-speaking community, are employed to maintain stealth and long-term access to target environments.