← threat actors
threat actor
Earth Kurma
also tracked as earth ammit 1
1 story · 1 in the wild · October 14, 2026 – October 14, 2026
evidence: 1 observed
sectors
- government 1 · Oct 14
- technology 1 · Oct 14
geography
- malaysia 1 · Oct 14
- philippines 1 · Oct 14
- south korea 1 · Oct 14
- taiwan 1 · Oct 14
- vietnam 1 · Oct 14
malware and tools
- acr stealer 1 · Oct 14
- coffeeloader 1 · Oct 14
techniques
- defense evasion 1 · Oct 14
- execution 1 · Oct 14
attack phases seen
- Defense evasion 1 · Oct 14
- Execution 1 · Oct 14
what we reported, newest first, grouped by story
October 14, 2026
- Windows Fibers are being used to run arbitrary code inside an existing thread, with no new thread creation — a thread-creation-free execution primitive that sidesteps a common detection anchor. @ipurple ties the technique to Earth Ammit and Earth Kurma activity involving CoffeeLoader and ACR Stealer against government and technology targets in South Korea, Taiwan, the Philippines, Vietnam and Malaysia.
· Oct 14 · observed · as earth ammit · Offensive Tradecraft & Research