Earth Lusca — Threat Actors — SecurityStudies.info

Profile

Also known as: AQUATIC PANDA, BountyGlad, BRONZE UNIVERSITY, Charcoal Typhoon, CHROMIUM, ControlX, FISHMONGER, Red Dev 10, Red Scylla, RedHotel, TAG-22

Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.

Related profiles: APT41, Earth Krahang

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 44

Reconnaissance

T1595.002Vulnerability Scanning

Resource Development

T1583.001Domains T1583.004Server T1583.006Web Services T1584.004Server T1584.006Web Services T1588.001Malware T1588.002Tool T1608.001Upload Malware

Initial Access

T1189Drive-by Compromise T1190Exploit Public-Facing Application T1566.002Spearphishing Link

Execution

T1047Windows Management Instrumentation T1053.005Scheduled Task T1059.001PowerShell T1059.005Visual Basic T1059.006Python T1059.007JavaScript T1204.001Malicious Link T1204.002Malicious File T1574.001DLL

Persistence

T1098.004SSH Authorized Keys T1112Modify Registry T1543.003Windows Service T1547.012Print Processors

Privilege Escalation

T1548.002Bypass User Account Control

Stealth

T1027Obfuscated Files or Information T1027.003Steganography T1036.005Match Legitimate Resource Name or Location T1140Deobfuscate/Decode Files or Information T1218.005Mshta

Credential Access

T1003.001LSASS Memory T1003.006DCSync

Discovery

T1007System Service Discovery T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery T1482Domain Trust Discovery

Lateral Movement

T1210Exploitation of Remote Services

Collection

T1560.001Archive via Utility

Command and Control

T1090Proxy

Exfiltration

T1567.002Exfiltration to Cloud Storage

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential