Earth Lusca

Overview

Earth Lusca is a suspected China-based advanced persistent threat (APT) group that has been active since at least April 2019. Tracked by Trend Micro under the Earth Lusca designation, the group is also identified as TAG-22 by Recorded Future, Charcoal Typhoon (formerly CHROMIUM) by Microsoft, RedHotel by Insikt Group, and Aquatic Panda by CrowdStrike. The group operates under the broader Winnti umbrella of Chinese threat actors but maintains its own distinct infrastructure and tooling.

Earth Lusca conducts dual-purpose operations: strategic cyber espionage targeting entities aligned with Chinese government interests, and financially motivated attacks against cryptocurrency platforms and gambling companies. Targets have spanned at least 17 countries across Asia, Europe, North America, and Africa, including government institutions, educational organizations, telecommunications providers, news media, pro-democracy movements, religious groups, and COVID-19 research bodies.

In March 2025, the U.S. Department of Justice charged 12 Chinese nationals in connection with state-backed hacking operations linked to i-Soon (Anxun Information Technology), the Chengdu-based private contractor believed to manage Earth Lusca's penetration teams. The FBI confirmed that activities associated with i-Soon are tracked under the Earth Lusca, Aquatic Panda, Charcoal Typhoon, BRONZE UNIVERSITY, and RedHotel designations. Leaked i-Soon documents revealed victim overlap, shared malware arsenals (including ShadowPad and Winnti), and geographic co-location in Chengdu between i-Soon and Earth Lusca operators. The company reportedly carried out intrusions on behalf of both China's Ministry of State Security (MSS) and Ministry of Public Security (MPS), generating tens of millions of dollars in revenue.

A related but operationally separate intrusion set, Earth Krahang, has been identified by Trend Micro as potentially another penetration team operating under the same i-Soon umbrella. Earth Krahang focused on compromising government infrastructure across 45 countries and using that access to attack additional government entities, sharing limited infrastructure with Earth Lusca.

Target Profile

Earth Lusca targets organizations that align with Chinese strategic intelligence priorities, while also conducting financially motivated operations for profit. Targeting has been confirmed across Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, Japan, and the United States.

• Government institutions: Primary target sector, with focus on foreign affairs, technology, and telecommunications ministries. Confirmed victims in Taiwan, Thailand, Philippines, Vietnam, UAE, Mongolia, Nigeria, and a U.S. state legislature (2022).
• Academic and research: Educational institutions in Taiwan, Hong Kong, Japan, and France. COVID-19 research organizations in the United States were targeted during the pandemic period.
• Media and civil society: News media outlets in Taiwan, Hong Kong, Australia, Germany, and France. Pro-democracy and human rights organizations in Hong Kong, as well as religious movements banned in mainland China.
• Telecommunications: Telecom companies across the Asia-Pacific region, likely for intelligence collection and communications surveillance capabilities.
• Financial and cryptocurrency: Gambling companies in China and various cryptocurrency trading platforms have been hit in attacks that appear purely financially motivated, distinguishing Earth Lusca from strictly espionage-focused APTs.

Tactics, Techniques & Procedures

Documented TTPs based on observed campaigns and public threat intelligence. Earth Lusca uses three primary initial access vectors: exploitation of public-facing server vulnerabilities, spearphishing emails with malicious links or attachments, and watering hole attacks using compromised legitimate websites injected with malicious JavaScript. Post-compromise activity typically involves deploying Cobalt Strike for lateral movement, followed by advanced backdoors for long-term persistence.

mitre id	technique	description
T1190	Exploit Public-Facing Application	Exploits N-day vulnerabilities in public-facing servers including Microsoft Exchange (ProxyShell), Fortinet (CVE-2022-40684, CVE-2022-39952), GitLab (CVE-2021-22205), Oracle GlassFish, Zimbra (CVE-2019-9670, CVE-2019-9621), and Telerik UI (CVE-2019-18935).
T1566.002	Phishing: Spearphishing Link	Sends spearphishing emails containing malicious links to targets. Emails are tailored to the victim's interests and may contain geopolitically themed lure documents (e.g., China-Taiwan relations content).
T1189	Drive-by Compromise	Conducts watering hole attacks by compromising legitimate websites and injecting malicious JavaScript to redirect visitors to attacker-controlled infrastructure.
T1574.001	Hijack Execution Flow: DLL Side-Loading	Uses DLL side-loading extensively, including placing malicious payloads in system paths (e.g., MSDTC service via oci.dll) and abusing legitimate code-signed executables from vendors like Qihoo.
T1059.001	Command and Scripting Interpreter: PowerShell	Uses PowerShell for command execution, network reconnaissance (reading RDP event logs), and lateral movement within compromised environments.
T1003.001	OS Credential Dumping: LSASS Memory	Uses ProcDump and Mimikatz to dump LSASS process memory for credential harvesting. Also performs DCSync attacks against domain controllers using the ZeroLogon exploit (CVE-2020-1472).
T1027.003	Obfuscated Files or Information: Steganography	Hides shellcode within BMP image files to evade detection during payload delivery.
T1567.002	Exfiltration Over Web Service: Cloud Storage	Uses the megacmd tool to upload stolen files from victim networks to MEGA cloud storage for exfiltration.
T1053.005	Scheduled Task/Job: Scheduled Task	Creates scheduled tasks for persistence using commands like schtasks /Create with ONLogon triggers and SYSTEM-level execution.
T1547.012	Boot or Logon Autostart Execution: Print Processors	Registers malicious DLLs as Windows print processors via registry modification, loading malware through the Print Spooler service.

Known Campaigns

Confirmed or highly attributed operations linked to this threat actor.

Tools & Malware

Known custom and commodity tools associated with this actor. Earth Lusca maintains a diverse arsenal spanning both custom-developed malware and widely shared Chinese APT tooling.

• Cobalt Strike: Commercial adversary simulation framework heavily abused by Earth Lusca as a primary post-exploitation tool. Deployed after initial access via spearphishing, watering holes, or server exploitation. Used for command execution, lateral movement, and as a staging platform for additional payloads.
• ShadowPad: Modular backdoor shared across multiple Chinese APT groups. Supports plug-in-based functionality including keylogging, screenshot capture, file retrieval, and surveillance. Earth Lusca was among the first groups observed using a new obfuscation method for ShadowPad in late 2020. Remains encrypted on disk and decodes only in memory.
• SprySOCKS: Custom Linux backdoor discovered by Trend Micro in September 2023. Based on the open-source Windows backdoor Trochilus, with functions rewritten for Linux. Named for its swift behavior and SOCKS implementation. C2 protocol resembles RedLeaves, and the interactive shell is similar to the Linux variant of Derusbi. Still under active development at time of discovery.
• KTLVdoor: Cross-platform Golang backdoor discovered in September 2024. Supports both Windows (.dll) and Linux (.so) and masquerades as system utilities (sshd, Java, SQLite, bash, edr-agent). Features file manipulation, command execution, remote port scanning, and highly obfuscated configuration using a "KTLV" marker. Over 50 C2 servers on Alibaba infrastructure were identified.
• Winnti (Linux variant): Linux version of the Winnti backdoor, a signature tool of the broader Winnti collective. Used for long-term persistent access in espionage operations. Supports traffic signaling and encrypted communications.
• Doraemon: Older backdoor first encountered around 2016 in incidents involving Korean and Taiwanese gaming companies. Named for its original DLL filename (Doraemon.dll). Rarely discussed publicly but deployed by Earth Lusca in later operations.
• Mimikatz: Open-source credential harvesting tool used for LSASS memory dumping, DCSync attacks, and exploitation of the ZeroLogon vulnerability (CVE-2020-1472) against domain controllers.
• PowerSploit: Open-source PowerShell post-exploitation framework used for reconnaissance, privilege escalation, and credential access within compromised environments.
• NBTscan: Network scanner used for NetBIOS name resolution and host discovery during lateral movement.
• Cobalt Strike Aggressor Scripts: Custom CNA scripts that send notifications (via messaging APIs) when a new beacon initializes, enabling rapid operator response to successful infections.
• BIOPASS RAT: Previously unreported remote access trojan discovered during Earth Lusca monitoring, used in watering hole attacks targeting Chinese gambling companies.

Indicators of Compromise

Publicly available IOCs from Trend Micro and community reporting. Verify currency before operational use.

Mitigation & Defense

Recommended defensive measures for organizations in this actor's target profile. Earth Lusca relies heavily on exploiting known vulnerabilities and social engineering, making timely patching and user awareness the highest-impact defenses.

• Patch public-facing servers immediately: Prioritize patching for Microsoft Exchange (ProxyShell, ProxyLogon), Fortinet FortiOS, GitLab, Zimbra, Oracle GlassFish, and Telerik UI. Earth Lusca actively scans for and exploits N-day vulnerabilities in internet-exposed services. Implement a centralized patch management system and track CISA's Known Exploited Vulnerabilities catalog.
• Harden email and web gateways: Deploy advanced email filtering to detect spearphishing links and malicious archive attachments (.7z, .LNK files). Block execution of LNK files from archive downloads and monitor for obfuscated JavaScript payloads. Train users to recognize geopolitically themed social engineering lures.
• Monitor for Cobalt Strike and ShadowPad indicators: Deploy behavioral detection rules for Cobalt Strike beacon activity, including named pipe patterns, malleable C2 profiles, and in-memory injection. Monitor for ShadowPad's characteristic DNS-based C2 and domain generation algorithms. Implement memory scanning capabilities, as ShadowPad decodes only in memory.
• Protect credential stores: Monitor for LSASS memory access by non-standard processes (ProcDump, Mimikatz). Enable Credential Guard on Windows systems. Audit for DCSync activity and ZeroLogon exploitation attempts (CVE-2020-1472). Implement privileged access management for domain admin accounts.
• Secure Linux infrastructure: Monitor for SprySOCKS and KTLVdoor activity on Linux servers. Audit for unexpected ELF binaries, unusual SOCKS proxy connections, and processes masquerading as system utilities (sshd, java, bash). Check /root/.ssh for unauthorized SSH keys planted for persistent access.
• Segment and monitor lateral movement: Implement network segmentation to limit blast radius. Monitor for abnormal RDP connections, WMI execution, and PowerShell-based network discovery. Alert on WinRAR archive creation in sensitive directories and outbound connections to MEGA cloud storage (megacmd exfiltration).
• Detect DLL side-loading and persistence: Monitor the Print Spooler service for unauthorized print processor registrations. Audit registry keys at HKLM\SYSTEM\ControlSet001\Control\Print\Environments and HKCU\Environment\UserInitMprLogonScript for malicious modifications. Watch for new Windows services created with suspicious binpath values.
• Implement web application firewalls: Deploy WAF protection on all public-facing web servers. Monitor for vulnerability scanning activity and injection attempts. Reduce attack surface by disabling unnecessary services and enforcing the principle of least privilege on server configurations.

Sources & Further Reading

Attribution and references used to build this profile.

• Trend Micro — Delving Deep: An Analysis of Earth Lusca's Operations (2022)
• MITRE ATT&CK — Earth Lusca Group G1006
• Trend Micro — Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections (2024)
• Dark Reading — China's Earth Lusca Propagates Multiplatform Backdoor (2024)
• Trend Micro — Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks (2024)
• Recorded Future Insikt Group — RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale (2023)
• Recorded Future Insikt Group — Chinese State-Sponsored Activity Group TAG-22 (2021)
• The Hacker News — U.S. Charges 12 Chinese Nationals in State-Backed Hacking Operations (2025)
• SOCRadar — Dark Web Profile: Aquatic Panda (2025)
• Malpedia — Earth Lusca Threat Actor Profile