Earth LuscaThreat actor
- Aquatic Panda
- bountyglad
- BRONZE UNIVERSITY
- charcoal typhoon
- chromium
- controlx
- fishmonger
- red dev 10
- red scylla
- redhotel
- tag-22
Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti.From MISP Galaxy
Last reported yesterday, by The Hacker News7 reports
ATT&CK techniques
6 of 65 · each with the sentence it comes from- T1553.002Code Signing
“…onitoring persistence mechanisms with Autoruns and EDR solutions, and restricting AutoIt execution through AppLocker or WDAC based on code-signing information.”
- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1070.004File Deletion
“T1070.004”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations“FishMonger, also tracked as Aquatic Panda and Earth Lusca, is assessed to be operating under the APT41 umbrella.”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“The hands-on post-exploitation toolkit (iox, fscan, suo5, Neo-reGeorg, etc.) is consistent with Earth Lusca and UAT-5918 operations among others targeting government and education sectors across Asia.”
-
Arsenal de FishMonger actualizado: SprySOCKS para Windows“También es conocido como Earth Lusca, TAG-22, Aquatic Panda o Red Dev 10.”
-
FishMonger’s arsenal upgraded: SprySOCKS for Windows“It is also known as Earth Lusca, TAG-22, Aquatic Panda, or Red Dev 10.”
-
JSAC2026 -Day 1-“Joseph Chen examined activities attributed to “Earth Lusca” and “Earth Krahang,” both reportedly linked to the Chinese company i-Soon.”
-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“The BIOPASS RAT campaign is linked to another threat actor, Earth Lusca.”
-
Update to the REF2924 intrusion set and related campaigns“SHADOWPAD is a malware family that SecureWorks CTU has associated with the BRONZE UNIVERSITY threat group and Positive Technologies ETC has associated with the Winnti group.”
Indicators in its reports
named in the reports above- ffc3aa7909d4e72c…60dffe5c99b7in 2 reports
- 207.148.78[.]36in 2 reports
- 207.148.75[.]122in 2 reports
- 955bfc3dcc867256…0779fa3416d8in 2 reports
- 44dc4a08c5eb0972…4e06f09006bbin 2 reports
- ab87b29b6f79487c…9001e536f083in 2 reports
- 6490b8e4aade25a3…2db2122470bcin 2 reports
- e7484c24b88a1a24…9a993670285bin 2 reports
Copy these 8 indicators · defanged
Thanks — we review every report.