Earth Lusca

Actor Type	Commercial Provider
Attributed to Nation	China
Directly Linked Intrusion Sets	RedHotel , TAG-22
Associated Threat Actor	i-SOON

Earth Lusca is an intrusion set which has been observed by Trend Micro since 2021. The group use spear phishing and watering holes to gain initial access to targets and have been observed using the Winnti malware.

The groups targets include government, pro-democracy and human rights organizations in Hong Cong, educational institutions and more, primarily for espionage purposes.

Trend Micro also report instances of the group conducting financially motivated attacks against gambling and cryptocurrency companies.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

Earth Lusca Threat Reports

Report

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections

Blog post from researchers at Trend Micro discussing Earth Lusca and potential links to Chinese contractor I-Soon. Earth Lusca is a China-linked ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1564.001	Hidden Files and Directories	Defense Evasion
T1140	Deobfuscate/Decode Files or Information	Defense Evasion
T1083	File and Directory Discovery	Discovery
T1027.012	LNK Icon Smuggling	Defense Evasion
T1001	Data Obfuscation	Command and Control
T1027.009	Embedded Payloads	Defense Evasion
T1059.003	Windows Command Shell	Execution
T1204.001	Malicious Link	Execution
T1041	Exfiltration Over C2 Channel	Exfiltration
T1059.007	JavaScript	Execution
T1204.002	Malicious File	Execution
T1036.007	Double File Extension	Defense Evasion
T1573	Encrypted Channel	Command and Control
T1132	Data Encoding	Command and Control
T1027.002	Software Packing	Defense Evasion
T1202	Indirect Command Execution	Defense Evasion
T1574.001	DLL Search Order Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1566.002	Spearphishing Link	Initial Access

Showing 1 to 18 of 18 entries

Earth Lusca

Cyber Threat Graph Context

Earth Lusca Threat Reports

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections

References

go.recordedfuture.com

www.trendmicro.com

www.trendmicro.com

www.trendmicro.com

MITRE ATT&CK Techniques