Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Earth Lusca · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

Earth Lusca

  • CHROMIUM
  • ControlX
  • TAG-22
  • FISHMONGER
  • BRONZE UNIVERSITY
  • AQUATIC PANDA
  • Red Dev 10
  • RedHotel

MITRE G1006 ↗

Earth Lusca — ATT&CK roseEL

attack rose · 44 techniques across 14 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2020-1472

Analyst brief

misp-galaxy + mitre-attack

Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.

Observed targets (as stated by the sources)

15 countries · 10 sectors
AustraliaChinaFranceGermanyHong KongJapanMongoliaNepalNigeriaPhilippinesTaiwanThailandUnited Arab EmiratesUnited StatesVietnamAssessed origin: China

assessed origin · Chinaobserved targets · 15

countries · 15

  • Australia
  • China
  • France
  • Germany
  • Hong Kong
  • Japan
  • Mongolia
  • Nepal
  • Nigeria
  • Philippines
  • Taiwan
  • Thailand
  • United Arab Emirates
  • United States
  • Vietnam

sectors · 10

  • Gambling companies
  • Government Institutions
  • Education
  • Media and Entertainment
  • Pro-democracy and human rights political organizations
  • Telecommunications
  • Religious organization
  • Cryptocurrency
  • Medical
  • Covid-19 research organizations

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

44 techniques · 14 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    8 techniques

  3. Initial access

    3 techniques

  4. Execution

    8 techniques

  5. Persistence

    3 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    6 techniques

  8. Defense impairment

    1 technique

  9. Credential access

    2 techniques

  10. Discovery

    7 techniques

  11. Lateral movement

    1 technique

  12. Collection

    1 technique

  13. Command and control

    1 technique

  14. Exfiltration

    1 technique

select a technique

Arsenal

3 malware · 6 tools
Malware
Malware · 3ATT&CK
Cobalt StrikeS0154 ↗
Winnti for LinuxS0430 ↗
ShadowPadS0596 ↗
Tools
Tools · 6ATT&CK
MimikatzS0002 ↗
PowerSploitS0194 ↗
TasklistS0057 ↗
certutilS0160 ↗
NltestS0359 ↗
NBTscanS0590 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Earth Lusca is cited as exploiting

none on KEV
  1. CVE-2020-14722026-10-17
    1. “Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

22 sources
  1. 1.hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operation…
  2. 2.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-l…
  3. 3.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan
  4. 4.query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi
  5. 5.media-exp1.licdn.com/dms/document/C561FAQHhWFRcWmdCPw/feedshare-document-pd…
  6. 6.sentinelone.com/wp-content/uploads/2021/08/SentinelOne_-SentinelLabs_S…
  7. 7.pwc.co.uk/issues/cyber-security-services/research/chasing-shadow…
  8. 8.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-…
  9. 9.decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monp…
  10. 10.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/c…
  11. +12 more in the JSON record

Track Earth Lusca on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.