Earth Lusca
- ID
- G1006
- Associated names
- TAG-22, Charcoal Typhoon, CHROMIUM, ControlX
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]
Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]
Techniques used (44)
- T1003.001 LSASS Memory
- T1003.006 DCSync
- T1007 System Service Discovery
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1090 Proxy
- T1098.004 SSH Authorized Keys
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1218.005 Mshta
- T1482 Domain Trust Discovery
- T1543.003 Windows Service
- T1547.012 Print Processors
- T1548.002 Bypass User Account Control
- T1560.001 Archive via Utility
- T1566.002 Spearphishing Link
- T1567.002 Exfiltration to Cloud Storage
- T1574.001 DLL
- T1583.001 Domains
- T1583.004 Server
- T1583.006 Web Services
- T1584.004 Server
- T1584.006 Web Services
- T1588.001 Malware
- T1588.002 Tool
- T1595.002 Vulnerability Scanning
- T1608.001 Upload Malware
Software used (9)
- S0002 Mimikatz
- S0057 Tasklist
- S0154 Cobalt Strike
- S0160 certutil
- S0194 PowerSploit
- S0359 Nltest
- S0430 Winnti for Linux
- S0590 NBTscan
- S0596 ShadowPad