[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDYrdEV_DJiHdrt9gVq1wWeq22_zhDCfVA_FKB0zIcLA":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":20,"country":21,"suspected_sponsor":22,"target_industries":23,"target_countries":34,"incident_types":50,"references":51,"techniques":69,"technique_count":132,"created_at":133,"seoMetadata":134,"schemaOrg":138},"Earth Lusca","earth-lusca",[9,10,11,12,13,14,15,16,17,18,19],"CHROMIUM","ControlX","TAG-22","FISHMONGER","BRONZE UNIVERSITY","AQUATIC PANDA","Red Dev 10","RedHotel","Charcoal Typhoon","BountyGlad","Red Scylla","Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.","CN",null,[24,25,26,27,28,29,30,31,32,33],"Gambling companies","Government Institutions","Education","Media and Entertainment","Pro-democracy and human rights political organizations","Telecommunications","Religious organization","Cryptocurrency","Medical","Covid-19 research organizations",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"Australia","China","France","Germany","Hong Kong","Japan","Mongolia","Nepal","Nigeria","Philippines","Taiwan","Thailand","United Arab Emirates","United States","Vietnam",[],[52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68],"https:\u002F\u002Fhello.global.ntt\u002F-\u002Fmedia\u002Fntt\u002Fglobal\u002Finsights\u002Fwhite-papers\u002Fthe-operations-of-winnti-group.pdf","https:\u002F\u002Fwww.trendmicro.com\u002Fcontent\u002Fdam\u002Ftrendmicro\u002Fglobal\u002Fen\u002Fresearch\u002F22\u002Fa\u002Fearth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques\u002Ftechnical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf","https:\u002F\u002Fwww.recordedfuture.com\u002Fchinese-group-tag-22-targets-nepal-philippines-taiwan","https:\u002F\u002Fquery.prod.cms.rt.microsoft.com\u002Fcms\u002Fapi\u002Fam\u002Fbinary\u002FRWMFIi","https:\u002F\u002Fmedia-exp1.licdn.com\u002Fdms\u002Fdocument\u002FC561FAQHhWFRcWmdCPw\u002Ffeedshare-document-pdf-analyzed\u002F0\u002F1639591145314?e=1658966400&v=beta&t=_uCcyEVg6b_VDiBTvWQIXtBOdQ1GQAAydqGyq62KA3E","https:\u002F\u002Fwww.sentinelone.com\u002Fwp-content\u002Fuploads\u002F2021\u002F08\u002FSentinelOne_-SentinelLabs_ShadowPad_WP_V2.pdf","https:\u002F\u002Fwww.pwc.co.uk\u002Fissues\u002Fcyber-security-services\u002Fresearch\u002Fchasing-shadows.html","https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Foverwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools","https:\u002F\u002Fdecoded.avast.io\u002Fluigicamastra\u002Fbackdoored-client-from-mongolian-ca-monpass","https:\u002F\u002Fwww.pwc.com\u002Fgx\u002Fen\u002Fissues\u002Fcybersecurity\u002Fcyber-threat-intelligence\u002Fcyber-year-in-retrospect\u002Fyir-cyber-threats-report-download.pdf","https:\u002F\u002Fgo.recordedfuture.com\u002Fhubfs\u002Freports\u002Fcta-2023-0808.pdf","https:\u002F\u002Fsecurelist.com\u002Fapt-annual-review-2021\u002F105127","https:\u002F\u002Fsecurelist.com\u002Fapt-trends-report-q2-2021\u002F103517","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fstatic-assets\u002Fdocuments\u002Fmalware-analysis-reports\u002Fjolly-jellyfish\u002FNCSC-MAR-Jolly-Jellyfish.pdf","https:\u002F\u002Fwww.pwc.com\u002Fgx\u002Fen\u002Fissues\u002Fcybersecurity\u002Fcyber-threat-intelligence\u002Fcyber-year-in-retrospect\u002Fpdf\u002F2022-year-in-retrospect-report.pdf","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=-7Swd1ZetiQ","https:\u002F\u002Fwww.welivesecurity.com\u002Fen\u002Feset-research\u002Foperation-fishmedley\u002F",[70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131],"T1548","T1548.002","T1098","T1098.004","T1583","T1583.001","T1583.004","T1583.006","T1595","T1595.002","T1560","T1560.001","T1547","T1547.012","T1059","T1059.001","T1059.005","T1059.006","T1059.007","T1584","T1584.004","T1584.006","T1543","T1543.003","T1140","T1482","T1189","T1567","T1567.002","T1190","T1210","T1574","T1036","T1036.005","T1112","T1027","T1027.003","T1588","T1588.001","T1588.002","T1003","T1003.001","T1003.006","T1566","T1566.002","T1057","T1090","T1018","T1053","T1608","T1608.001","T1218","T1218.005","T1016","T1049","T1033","T1007","T1204","T1204.001","T1204.002","T1047","T1574.001",62,"2023-08-09T17:25:09.409843+00:00",{"title":135,"metaDescription":136,"keywords":137},"Earth Lusca Threat Actor Profile | Precursor Intelligence","Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommun...","Earth Lusca, CHROMIUM, ControlX, TAG-22, FISHMONGER, BRONZE UNIVERSITY, AQUATIC PANDA, Red Dev 10, RedHotel, Charcoal Typhoon, BountyGlad, Red Scylla, threat actor, APT, cyber threat, threat intelligence, Gambling companies, Government Institutions, Education, CN",{"@context":139,"@type":140,"name":6,"alternateName":141,"description":20,"url":142,"mainEntityOfPage":143,"location":145},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18,19],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fearth-lusca",{"@type":144,"@id":142},"WebPage",{"@type":146,"name":21},"Country"]