State-backedChina MITRE G1006

Earth Lusca

Also known as CHROMIUM, ControlX, TAG-22, FISHMONGER, BRONZE UNIVERSITY, AQUATIC PANDA, Red Dev 10, RedHotel, Charcoal Typhoon, BountyGlad, Red Scylla

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.

Targets: Gambling companies, Government Institutions, Education, Media and Entertainment, Pro-democracy and human rights political organizations, Telecommunications, Religious organization, Cryptocurrency, Medical, Covid-19 research organizations, Australia, China, France, Germany, Hong Kong

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.006 DCSync T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1027 Obfuscated Files or Information T1027.003 Steganography T1033 System Owner/User Discovery T1036.005 Match Legitimate Resource Name or Location T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.005 Scheduled Task T1057 Process Discovery T1059.001 PowerShell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1090 Proxy T1098.004 SSH Authorized Keys T1112 Modify Registry T1140 Deobfuscate/Decode Files or Information T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1204.001 Malicious Link T1204.002 Malicious File T1210 Exploitation of Remote Services T1218.005 Mshta T1482 Domain Trust Discovery T1543.003 Windows Service T1547.012 Print Processors T1548.002 Bypass User Account Control T1560.001 Archive via Utility T1566.002 Spearphishing Link T1567.002 Exfiltration to Cloud Storage T1574.001 DLL T1583.001 Domains T1583.004 Server T1583.006 Web Services T1584.004 Server T1584.006 Web Services T1588.001 Malware T1588.002 Tool T1595.002 Vulnerability Scanning T1608.001 Upload Malware

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.