China-Aligned APTs Launch “Premier Pass-as-a-Service,” Sharing Access in Coordinated Global Espionage

A new Trend Research report highlights unprecedented collaboration among China-aligned APT groups, describing a model called “Premier Pass-as-a-Service” that sees access brokers such as Earth Estries handing compromised assets to Earth Naga (also known as Flax Typhoon, RedJuliett, or Ethereal Panda) to extend exploitation and data exfiltration.

According to Trend Research, this approach enables one group to pass privileged access directly to another, bypassing lengthy reconnaissance phases and complicating detection and attribution.

The report notes that Earth Estries acted as an access broker and that joint operations have targeted telecommunications, government agencies, and defence-related manufacturers across APAC and NATO countries, with activities including a retail firm in APAC (November 2024), a Southeast Asian government agency (March 2025), and multiple APAC and NATO telecommunications providers (April–July 2025).

The investigation also reveals overlapping toolsets, with Earth Estries deploying the CrowDoor backdoor and Earth Naga using ShadowPad, a known Earth Naga backdoor linked to its infrastructure, indicating deliberate sharing of access and infrastructure. In early 2025, Earth Estries compromised a vulnerable internal web server to deploy CrowDoor, followed by ShadowPad deployment in March 2025 via Cobalt Strike SMB beacons and compromised credentials.