MITRE ATT&CKgroup
G1006 Earth Lusca
- Domain
- enterprise, mobile
- Aliases
- TAG-22, Charcoal Typhoon, CHROMIUM, ControlX
- Version
- 2.1
- Created
- 2022-07-01
Description
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.
Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.
Related
Uses · MITRE ATT&CK (53)
- S0596 ShadowPad software (malware)
- S0590 NBTscan software (tool)
- T1608.001 Upload Malware sub-technique
- T1547.012 Print Processors sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1583.004 Server sub-technique
- T1583.006 Web Services sub-technique
- T1584.004 Server sub-technique
- T1584.006 Web Services sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1098.004 SSH Authorized Keys sub-technique
- T1059.007 JavaScript sub-technique
- S0430 Winnti for Linux software (malware)
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1059.006 Python sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.006 DCSync sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.003 Steganography sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1218.005 Mshta sub-technique
References
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf TrendMicro EarthLusca 2022
- https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan Recorded Future TAG-22 July 2021
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf Recorded Future RedHotel August 2023
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023