- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, I-Soon
- Motivation
- Financial gain; Information theft and espionage
- Seen
- 2019–2026
- Status
- Active
- ATT&CK
- G1006 · 44 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0085 · earth-lusca
ChinaWhat it is
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.
Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- AQUATIC PANDA
- Microsoft
- Charcoal Typhoon
- MITRE ATT&CK
- G1006
- PwC
- Red Dev 10, Red Scylla
- Recorded Future
- TAG-22
- Operations
- Operation “FishMedley”
- Other names
- FishMedley, RedHotel, BountyGlad, Bronze University, CHROMIUM, ControlX, Fishmonger, RedHotel, TAG-22
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Afghanistan, Australia, Bangladesh, Bhutan, Cambodia, China, Czech, France, Germany, Hong Kong, India, Japan, Laos, Malaysia, Mongolia, Nepal, Nigeria, Pakistan, Philippines, Taiwan, Thailand, United Arab Emirates, United States, Vietnam
- Sectors
- Aerospace, Casinos and Gambling, Covid-19 research organizations, Cryptocurrency, Education, Gambling companies, Government, Government Institutions, Media, Media and Entertainment, Medical, Pro-democracy and human rights political organizations, Religious organization, Telecommunications
Tools
The tools and malware families the sources tie to it.
- AntSword
- BIOPASS RAT
- BadPotato
- Behinder
- Brute Ratel
- China Chopper
- Cobalt Strike
- CrossRat
- Doraemon
- EarthWorm
- FRP
- FunnySwitch
- HUC Port Banner Scanner
- KTLVdoor
- Mimikatz
- NBTscan
- Nltest
- PipeMon
- PowerSploit
- ShadowPad
- ShadowPad Winnti
- SodaMaster
- SprySOCKS
- Spyder
- Tasklist
- UNITEDRAKE
- Umbreon
- WinRAR
- Winnti
- Winnti for Linux
- certutil
- fscan
- lcx
- nbtscan
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de