Earth Lusca
MISPUnknown
CN
Unknown
[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)
[Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)
Tecniche Utilizzate (44)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1003.001 | LSASS Memory | - |
| T1003.006 | DCSync | - |
| T1007 | System Service Discovery | - |
| T1016 | System Network Configuration Discovery | - |
| T1018 | Remote System Discovery | - |
| T1027 | Obfuscated Files or Information | - |
| T1027.003 | Steganography | - |
| T1033 | System Owner/User Discovery | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1047 | Windows Management Instrumentation | - |
| T1049 | System Network Connections Discovery | - |
| T1053.005 | Scheduled Task | - |
| T1057 | Process Discovery | - |
| T1059.001 | PowerShell | - |
| T1059.005 | Visual Basic | - |
Riferimenti (10)
- hello.global.ntt - The Operations Of Winnti Group.pdf
- trendmicro.com - Technical Brief Delving Deep An Analysis Of Earth Lusca Operations.pdf
- recordedfuture.com - Chinese Group Tag 22 Targets Nepal Philippines Taiwan
- query.prod.cms.rt.microsoft.com - RWMFIi
- media-exp1.licdn.com - 1639591145314
- sentinelone.com - SentinelOne SentinelLabs ShadowPad WP V2.pdf
- pwc.co.uk - Chasing Shadows
- crowdstrike.com - Overwatch Exposes Aquatic Panda In Possession Of Log 4 Shell Exploit Tools
- decoded.avast.io - Backdoored Client From Mongolian Ca Monpass
- pwc.com - Yir Cyber Threats Report Download.pdf
Alias (1549)
Malware Utilizzato (9)
Metadata
| ID: | 373 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 04:00 |