Earth Lusca — APT Profile
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated. Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.Also tracked as
TAG-22, Charcoal Typhoon, CHROMIUM, ControlX, RedHotel
Tools & malware
- certutil LOLBin
- Cobalt Strike Adversary Simulation
- elf.ktlv_door Backdoor
- elf.spry_socks Tunneling Tool
- Mimikatz Credential Harvesting
- NBTscan Network Reconnaissance
- Nltest Network Reconnaissance
- PowerSploit Post-Exploitation Framework
- ShadowPad Backdoor
- Tasklist Discovery
- win.cobalt_strike Adversary Simulation
- win.dizzyvoid Backdoor
- win.fishmaster Backdoor
- win.funnyswitch Backdoor
- win.ktlv_door Backdoor
- win.njrat Remote Access Trojan
- win.shadowpad Backdoor
- Winnti for Linux Backdoor
Vendor research
- the original report ESET
- How Microsoft names threat actors Microsoft
- Delving Deep: An Analysis of Earth Lusca’s Operations TrendMicro
- Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling Recorded Future
- RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale Recorded Future