Earth Lusca

Origin🇨🇳 China

Techniques (MITRE ATT&CK)44

SourceMITRE ATT&CK

Target categories: Gambling companies, Government Institutions, Education, Media and Entertainment, Pro-democracy and human rights political organizations, Telecommunications, Religious organization, Cryptocurrency, Medical, Covid-19 research organizations

Targeted regions: Australia · China · France · Germany · Hong Kong · Japan · Mongolia · Nepal · Nigeria · Philippines +5

Also known as:AQUATIC PANDABRONZE UNIVERSITYBountyGladCHROMIUMCharcoal TyphoonControlXFISHMONGERRed Dev 10Red ScyllaRedHotelTAG-22

About the group

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated. Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity75

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 44

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Vulnerability Scanning

Resource development

Domains Server Web Services Server Web Services Malware Tool Upload Malware

Initial access

Drive-by Compromise Exploit Public-Facing Application Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell Visual Basic Python JavaScript Malicious Link Malicious File

Persistence

SSH Authorized Keys Windows Service Print Processors

Privilege escalation

Bypass User Account Control

Credential access

LSASS Memory DCSync

Discovery

System Service Discovery System Network Configuration Discovery Remote System Discovery System Owner/User Discovery System Network Connections Discovery Process Discovery Domain Trust Discovery

Lateral movement

Exploitation of Remote Services

Collection

Archive via Utility

Command and control

Proxy

Exfiltration

Exfiltration to Cloud Storage

defense-impairment

Modify Registry

stealth

Obfuscated Files or Information Steganography Match Legitimate Resource Name or Location Deobfuscate/Decode Files or Information Mshta DLL

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2020-1472MEDIUMEPSS 99%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

Known infrastructure 2993

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port114.215.184.158:8000Cobalt Strikethreatfox

urlhttp://69.49.229.88:443/MQEwCobalt Strikethreatfox

ip:port154.12.17.20:8080Cobalt Strikethreatfox

ip:port154.12.17.20:22Cobalt Strikethreatfox

ip:port154.12.17.20:443Cobalt Strikethreatfox

ip:port154.12.17.20:80Cobalt Strikethreatfox

ip:port129.204.55.230:443Cobalt Strikethreatfox

ip:port47.94.56.71:8080Cobalt Strikethreatfox

ip:port47.94.56.71:80Cobalt Strikethreatfox

ip:port47.94.56.71:443Cobalt Strikethreatfox

ip:port45.227.253.132:8080Cobalt Strikethreatfox

ip:port45.227.253.132:80Cobalt Strikethreatfox

ip:port45.227.253.132:443Cobalt Strikethreatfox

ip:port45.227.253.132:32775Cobalt Strikethreatfox

ip:port117.158.148.164:65535Cobalt Strikethreatfox

ip:port38.76.190.209:8888Cobalt Strikethreatfox

ip:port188.227.14.105:8080Cobalt Strikethreatfox

ip:port186.241.115.168:12443Cobalt Strikethreatfox

ip:port109.206.247.245:10881Cobalt Strikethreatfox

ip:port43.134.112.45:7500Cobalt Strikethreatfox

ip:port43.134.112.45:7000Cobalt Strikethreatfox

ip:port43.134.112.45:80Cobalt Strikethreatfox

ip:port43.134.112.45:8080Cobalt Strikethreatfox

ip:port43.134.112.45:443Cobalt Strikethreatfox

ip:port43.134.112.45:22Cobalt Strikethreatfox

ip:port101.34.208.175:18317Cobalt Strikethreatfox

sha1_hash2ff26540ebb9100dae76a2ae040108ba9338113cCobalt Strikethreatfox

md5_hashe4a34372eab0832d0682fa986a8e0b97Cobalt Strikethreatfox

sha256_hash35afe2df347cb0909fdf2aba8ed6a506a681518a98c0a723b25a16957437f944Cobalt Strikethreatfox

sha256_hash224aec5fec1f907ce152895095f56a3a2f2db0d627633ee691af56a13f34e7f8Cobalt Strikethreatfox

+2993 indicators in total. See them all on the IOCs page.

References

Earth Lusca uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →