Earth Lusca

MITRE ATT&CK: G1006 View on attack.mitre.org

Aliases: TAG-22, Charcoal Typhoon, CHROMIUM, ControlX, FISHMONGER, BRONZE UNIVERSITY, AQUATIC PANDA, Red Dev 10, RedHotel, BountyGlad, Red Scylla, Earth Lusca

First seen
2019-04-01 00:00:00
Origin
CN
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
nation-state
Related IoCs
33 (31 malicious)
Last IoC activity
2026-10-12 16:25:22
Profile updated
2026-07-07 12:32:40

Targeted industries: government-and-public-sector media-and-entertainment education-and-nonprofits technology-and-telecommunications healthcare-and-pharmaceutical financial-services

Targeted regions: country_code:au country_code:cn country_code:hk country_code:mn country_code:np country_code:ph country_code:tw country_code:th country_code:vn country_code:ae country_code:ng country_code:de country_code:fr country_code:us

Context

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated. Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.

Recent IoC activity

31 malicious indicators in Maltiverse are attributed to Earth Lusca (G1006). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname obo.videocenter.org 2026-10-12 1
hostname live.musicweb.xyz 2026-10-09 2
file sample 6dea7f976a3dc359e630ab5e85fa69f114fc046dcc363598e998e1ef9751bbed 2026-10-08 1
file sample bdc6a2985a07ef3c5d2ef2a0eb53afdfdbf757bfa080e8b77ba4b47c1a99b423 2026-10-08 1
file sample 152ef5fcd0278e127c3df415018857f3aed0a748160032356786815ccbe870d5 2026-10-07 2
file sample f8c5feaae3f8e4bfb37edf4e05d1ee91797023bdf71e1c45ed2711861b300f37 2026-10-05 1
file sample aea823d6446fbf9059391125a9b7fceb9f433b846275d28dc5f433645984a683 2026-10-04 2
hostname backdoor.win64.shadowpad.as 2026-10-03 1
file sample 16c6558634759e6efd4581de60cc2050d99a53245c6abde3d38fc140204777e9 2026-10-03 1
file sample af58e830feef2f4086fb52dafda6084b3b85c6200f4cbc35a5460fb703dd39df 2026-09-19 2
file sample 17272a56cbf8e479c085e88fe22243685fac2bc041bda26554aa716287714466 2026-09-18 1
file sample 05ed1feda4a1684f8f7907644500948f4488a60ecb0740f708e08c1812b7f122 2026-09-18 1
file sample 0122734490fe4dfb287d34394667d81ab46e0d05d4569d06a41f0f3c3a36448c 2026-09-18 1
file sample 4805a7a386fac1af9a80ab24d95ebf4699c35a7c38fcf3eefa571b9d67d7bf45 2026-09-18 1
file sample 253f474aa0147fdcf88beaae40f3a23bdadfc98b8dd36ae2d81c387ced2db4f1 2026-09-18 1
file sample 225b0adce4fab783d0962852894482e7452e5483bf955757cb25e6a26c3d3b38 2026-09-18 1
hostname valorantcheatsboss.com 2026-09-03 2
hostname tech.learningstudy.xyz 2026-09-03 2
file sample 7e8c6961a10c95a5d97aece92c2e2d974d63ede98196413cc0cf033f92084f53 2025-11-24 1
file sample 4e3a455e7f0b8f34385cd8320022719a8fc59d8bc091472990ac9a56e982a965 2025-10-24 2

Detection coverage

  • 159 YARA rules
  • 841 Sigma rules

Malware & tools used

  • Steganography (attack-pattern)
  • Upload Malware (attack-pattern)
  • SSH Authorized Keys (attack-pattern)
  • DCSync (attack-pattern)
  • Visual Basic (attack-pattern)
  • Drive-by Compromise (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Web Services (attack-pattern)
  • JavaScript (attack-pattern)
  • Exploitation of Remote Services (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Domains (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Print Processors (attack-pattern)
  • PowerShell (attack-pattern)
  • Python (attack-pattern)
  • Process Discovery (attack-pattern)
  • Scheduled Task (attack-pattern)
  • DLL (attack-pattern)
  • Modify Registry (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • LSASS Memory (attack-pattern)
  • Mshta (attack-pattern)
  • Domain Trust Discovery (attack-pattern)

Related threat objects

Reports & references

  • hello.global.ntt — The Operations Of Winnti Group (report)
  • Trend Micro — Technical Brief Delving Deep An Analysis Of Earth Lusca Operations (report)
  • recordedfuture.com — Chinese Group Tag 22 Targets Nepal Philippines Taiwan (report)
  • media-exp1.licdn.com — 1639591145314 (report)
  • sentinelone.com — Sentinelone Sentinellabs Shadowpad Wp V2 (report)
  • pwc.co.uk — Chasing Shadows (report)
  • CrowdStrike — Overwatch Exposes Aquatic Panda In Possession Of Log 4 Shell Exploit Tools (report)
  • decoded.avast.io — Backdoored Client From Mongolian Ca Monpass (report)
  • go.recordedfuture.com — Cta 2023 0808 (report)
  • Kaspersky — 105127 (report)
  • Kaspersky — 103517 (report)
  • ncsc.gov.uk — Ncsc Mar Jolly Jellyfish (report)
  • pwc.com — 2022 Year In Retrospect Report (report)
  • youtube.com — Watch (report)
  • ESET — Operation Fishmedley (report)
  • MITRE ATT&CK — G1006 (report)
  • recordedfuture.com — Chinese Group Tag 22 Targets Nepal Philippines Taiwan (report)
  • Microsoft — Microsoft Threat Actor Naming (report)
  • raw.githubusercontent.com — Microsoftmapping (report)
  • Microsoft — Rwmfii (report)
  • pwc.com — Yir Cyber Threats Report Download (report)

Attributed from

  • Citrine Sleet Chromium Zero-Day Exploit Activity (CVE-2024-7971) (campaign)

External references