Threat Group Cards: A Threat Actor Encyclopedia

Names	Earth Lamia (Trend Micro)
Country	China
Motivation	Information theft and espionage
First seen	2023
Description	(Trend Micro) Trend Research has identified Earth Lamia as an APT threat actor that exploits vulnerabilities in web applications to gain access to organizations, using various techniques for data exfiltration. Earth Lamia develops and customizes hacking tools to evade detection, such as PULSEPACK and BypassBoss. Earth Lamia has primarily targeted organizations in Brazil, India, and Southeast Asia since 2023. Initially focused on financial services, the group shifted to logistics and online retail, most recently focusing on IT companies, universities, and government organizations.
Observed	Sectors: Education, Financial, Government, IT, Retail, Shipping and Logistics. Countries: Brazil, India, Indonesia, Malaysia, Philippines, Thailand, Vietnam.
Tools used	BypassBoss, PULSEPACK.
Information	<https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html>

Last change to this card: 27 June 2025

Download this actor card in PDF or JSON format