Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:11:01 UTC
Home > List all groups > List all tools > List all groups using tool Crowdoor
 Tool: Crowdoor
Names Crowdoor
Category Malware
Type Backdoor
Description
(Trend Micro) The new backdoor variant, Crowdoor, has been observed to interact with the
Cobalt Strike installation, in keeping with Earth Estries’ tools, tactics, and procedures (TTPs)
of cleaning up and reinstalling tools. Both instances of Crowdoor and the reinstalled Cobalt
Strike were brought in as CAB files by preceding instances.
Information
<https://www.trendmicro.com/en_us/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html>
Last change to this tool card: 26 December 2024
Download this tool card in JSON format
All groups using tool Crowdoor
Changed Name Country Observed
APT groups
  Salt Typhoon, GhostEmperor 2020-Feb 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3fdda153-4916-40a6-b401-5c6d9fe7991d
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3fdda153-4916-40a6-b401-5c6d9fe7991d
Page 1 of 1