Earth Lusca
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations…
- ATT&CK ID
- G1006
- Origin
- China
- Weather family
- Typhoon
- Techniques
- 34
- Tools
- 9
Also tracked as TAG-22 · Charcoal Typhoon · CHROMIUM · ControlX
Vulnerabilities it has exploited
Techniques
Reconnaissance
Resource Development
Acquire InfrastructureCompromise InfrastructureObtain CapabilitiesStage Capabilities
Initial Access
Drive-by CompromiseExploit Public-Facing ApplicationPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobAccount ManipulationModify RegistryCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobAccount ManipulationCreate or Modify System ProcessBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationMasqueradingDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionHijack Execution Flow
Defense Impairment
Credential Access
Discovery
System Service DiscoverySystem Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoverySystem Network Connections DiscoveryProcess DiscoveryDomain Trust Discovery
Lateral Movement
Exploitation of Remote Services
Collection
Command and Control
Exfiltration
Software
Cobalt Strike · Mimikatz · NBTscan · Nltest · PowerSploit · ShadowPad · Tasklist · Winnti for Linux · certutil