Case trend-earth-krahang-naga-genaiState actor AI opsWorldwide
Trend Micro: Earth Krahang and Earth Naga fold generative AI into exploits and loaders
Trend Micro's H1 2026 APT report documented China-aligned Earth Krahang using GenAI to turn a public exploit into a mass scanner and Earth Naga iteratively vibe-coding a PowerShell and C# backdoor loader.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 29, 2026
- Location
- Worldwide
- Target
- Organisations with vulnerable WordPress servers and Windows
- Severity
- Medium
- Triggered by
- Earth Krahang and Earth Naga
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Trend Micro's H1 2026 APT report documented China-aligned Earth Krahang using GenAI to turn a public exploit into a mass scanner and Earth Naga iteratively vibe-coding a PowerShell and C# backdoor loader.
Impact: Large-scale automated vulnerability scanning and new loader tooling; victim counts not disclosed.
Who triggered it
Actor: Earth Krahang and Earth Naga
Attribution: Trend Micro attributes both to China-aligned actors; describes them as still in an exploratory phase of AI use.
Motive: Espionage
How it happened
Attack vector: AI-enhanced exploit scanning at scale and AI-written backdoor loaders
Root cause: Generative AI shortened exploit weaponisation and loader development for state operators
Timeline
- Activity observed during first half of 2026
- Trend Micro publishes H1 2026 APT report
Response
Trend Micro published the roundup with detection guidance.
Current status: Ongoing
Sources (open in a new tab)
- Trend Micro trendaisecurity.com
- Trend Micro newsroom newsroom.trendmicro.com
Cite this case
Trend Micro: Earth Krahang and Earth Naga fold generative AI into exploits and loaders. AI Threat Watch, case trend-earth-krahang-naga-genai, Jul 29, 2026. https://aithreat.io/cases/trend-earth-krahang-naga-genai/
Permanent link: https://aithreat.io/cases/trend-earth-krahang-naga-genai/