# Earth Lusca: threat group profile

> Earth Lusca is a threat group thought to operate from China. Public reporting links it to 34 attack techniques, and to attacks on gambling companies, government institutions and education organisations, with 15 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/earth-lusca
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > Earth Lusca

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 34 (plus 28 sub-techniques) |
| Countries and victims named | 15 |
| Thought to operate from | China |
| Other names | 11 |
| Public reports | 17 |

## Who is Earth Lusca?

Earth Lusca is a threat group thought to operate from China. Public reporting links it to 34 attack techniques, and to attacks on gambling companies, government institutions and education organisations, with 15 countries and victims named.

### Also known as

CHROMIUM, ControlX, TAG-22, FISHMONGER, BRONZE UNIVERSITY, AQUATIC PANDA, Red Dev 10, RedHotel, Charcoal Typhoon, BountyGlad, Red Scylla

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.

## How does Earth Lusca attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 34 linked to Earth Lusca. Some techniques belong to more than one stage. Public reporting also lists 28 more specific variations of them, called sub-techniques.

### 1. Research (1)

- T1595: Active Scanning

### 2. Preparation (4)

- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1588: Obtain Capabilities
- T1608: Stage Capabilities

### 3. Getting in (3)

- T1189: Drive-by Compromise
- T1190: Exploit Public-Facing Application
- T1566: Phishing

### 4. Running code (5)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1204: User Execution
- T1574: Hijack Execution Flow

### 5. Staying in (5)

- T1053: Scheduled Task/Job
- T1098: Account Manipulation
- T1112: Modify Registry
- T1543: Create or Modify System Process
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (5)

- T1053: Scheduled Task/Job
- T1098: Account Manipulation
- T1543: Create or Modify System Process
- T1547: Boot or Logon Autostart Execution
- T1548: Abuse Elevation Control Mechanism

### 7. Hiding (5)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1140: Deobfuscate/Decode Files or Information
- T1218: System Binary Proxy Execution
- T1574: Hijack Execution Flow

### 8. Disabling defences (1)

- T1112: Modify Registry

### 9. Stealing passwords (1)

- T1003: OS Credential Dumping

### 10. Looking around (7)

- T1007: System Service Discovery
- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1033: System Owner/User Discovery
- T1049: System Network Connections Discovery
- T1057: Process Discovery
- T1482: Domain Trust Discovery

### 11. Spreading (1)

- T1210: Exploitation of Remote Services

### 12. Gathering data (1)

- T1560: Archive Collected Data

### 13. Keeping contact (1)

- T1090: Proxy

### 14. Taking data out (1)

- T1567: Exfiltration Over Web Service

### 15. Causing damage (0)

- None linked in public reporting.

## Who does Earth Lusca go after?

**Sectors:** Gambling companies, Government Institutions, Education, Media and Entertainment, Pro-democracy and human rights political organizations, Telecommunications, Religious organization, Cryptocurrency, Medical, Covid-19 research organizations

**Countries and victims named:** Australia, China, France, Germany, Hong Kong, Japan, Mongolia, Nepal, Nigeria, Philippines, Taiwan, Thailand, United Arab Emirates, United States, Vietnam

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about Earth Lusca

- https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf
- https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi
- https://media-exp1.licdn.com/dms/document/C561FAQHhWFRcWmdCPw/feedshare-document-pdf-analyzed/0/1639591145314?e=1658966400&v=beta&t=_uCcyEVg6b_VDiBTvWQIXtBOdQ1GQAAydqGyq62KA3E
- https://www.sentinelone.com/wp-content/uploads/2021/08/SentinelOne_-SentinelLabs_ShadowPad_WP_V2.pdf
- https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html
- https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools
- https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf
- https://securelist.com/apt-annual-review-2021/105127
- https://securelist.com/apt-trends-report-q2-2021/103517
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/jolly-jellyfish/NCSC-MAR-Jolly-Jellyfish.pdf
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/pdf/2022-year-in-retrospect-report.pdf
- https://www.youtube.com/watch?v=-7Swd1ZetiQ
- https://www.welivesecurity.com/en/eset-research/operation-fishmedley/

## Frequently asked questions

### Who is Earth Lusca?

Earth Lusca is a threat group thought to operate from China. Public reporting links it to 34 attack techniques, and to attacks on gambling companies, government institutions and education organisations, with 15 countries and victims named.

### Where is Earth Lusca thought to be based?

Public reporting places Earth Lusca as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Earth Lusca target?

In public reporting, sectors named include gambling companies, government institutions, education, media and entertainment and pro-democracy and human rights political organizations, and 15 countries and victims are named, including Australia, China, France and Germany.

### How does Earth Lusca attack?

Public reporting links Earth Lusca to 34 attack techniques. Most of them are about looking around, running code and staying in.

### How do I know if Earth Lusca is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact