Sign inStart freeBook a demo

Earth Lusca threat group

Earth Lusca is a threat group thought to operate from China. Public reporting links it to 34 attack techniques, and to attacks on gambling companies, government institutions and education organisations, with 15 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Start free →Book a demo
ShareXLinkedIn
Attack techniques
34
Countries and victims named
15
Thought to operate from
China
Other names
11
Built from public reporting, with every source listed below.
Overview

Who is Earth Lusca?

Earth Lusca has 11 other names in security research. Below is what published reporting says about it, with a link to every report so you can check the detail yourself.

Also known as

CHROMIUMControlXTAG-22FISHMONGERBRONZE UNIVERSITYAQUATIC PANDARed Dev 10RedHotelCharcoal TyphoonBountyGladRed Scylla

Security companies each give the same group their own name, so one group can have many.

What public reporting says

Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.

Public reports about Earth Lusca (17)

How it works

How does Earth Lusca attack? Stage by stage.

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 34 linked to Earth Lusca, laid out from first look to final blow. Some techniques belong to more than one stage. Pick a stage to see them. Public reporting also lists 28 more specific variations of them, called sub-techniques.

Stage 10 of 15

Looking around

Mapping the network, accounts and data once inside.

7 techniques
  • T1007System Service Discovery
  • T1016System Network Configuration Discovery
  • T1018Remote System Discovery
  • T1033System Owner/User Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1482Domain Trust Discovery
Targets

Who does Earth Lusca go after?

The sectors and places named in public reporting about this group. If yours is on the list, it is worth knowing how they work and which flaws they use.

Sectors (10)

Gambling companiesGovernment InstitutionsEducationMedia and EntertainmentPro-democracy and human rights political organizationsTelecommunicationsReligious organizationCryptocurrencyMedicalCovid-19 research organizations
See threats by industry →

Countries and victims named (15)

  1. 01Australia
  2. 02China
  3. 03France
  4. 04Germany
  5. 05Hong Kong
  6. 06Japan
  7. 07Mongolia
  8. 08Nepal
  9. 09Nigeria
  10. 10Philippines
  11. 11Taiwan
  12. 12Thailand
  13. 13United Arab Emirates
  14. 14United States
  15. 15Vietnam
Free account

Is Earth Lusca a risk to you?

A public profile tells you who a group is. Your account tells you whether it matters to you: we match the software you run to the flaws threat groups use, and we keep watching, so you hear about anything that affects you as soon as we know.

  • Over 900 group profiles in the app, every claim backed by a quote and a source link.
  • Your sector at a glance: which threat groups and ransomware gangs are hitting it.
  • Flaws in the software you run, ranked 0 to 100, with threat group activity counted in.
  • A PDF dossier on any group, ready to send to your board or your IT provider.
Start free →Book a demo
FAQ

Questions about Earth Lusca

Something else? Talk to the team →

Earth Lusca is a threat group thought to operate from China. Public reporting links it to 34 attack techniques, and to attacks on gambling companies, government institutions and education organisations, with 15 countries and victims named.

Public reporting places Earth Lusca as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

In public reporting, sectors named include gambling companies, government institutions, education, media and entertainment and pro-democracy and human rights political organizations, and 15 countries and victims are named, including Australia, China, France and Germany.

Public reporting links Earth Lusca to 34 attack techniques. Most of them are about looking around, running code and staying in.

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

Get started

Find out what groups like this could use against you.

Create a free account and tell us the software you run. We match the software you run against flaws threat groups use, rank them 0 to 100 and keep watching, so you hear about it as soon as we know.

Start free →Book a demo

No card neededNothing to installIntelligence and alerts free