Earth Lusca
CHROMIUMControlXTAG-22FISHMONGERBRONZE UNIVERSITYAQUATIC PANDARed Dev 10RedHotelCharcoal TyphoonBountyGladRed Scylla
Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting… Source: MISP
Attributed country: CN according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 16 Jun 2026 · last seen on 16 Jun 2026
News
- Arsenal de FishMonger actualizado: SprySOCKS para WindowsWeLiveSecurity · 16 Jun 2026
Appears alongside
MITRE ATT&CK techniques
Reconnaissance
Resource Development
T1583.001DomainsT1583.004ServerT1583.006Web ServicesT1584.004ServerT1584.006Web ServicesT1588.001Malware 1 Sigma rulesT1588.002Tool 7 Sigma rulesT1608.001Upload Malware
Initial Access
T1189Drive-by Compromise 3 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rulesT1566.002Spearphishing Link 3 Sigma rules
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.005Visual Basic 28 Sigma rulesT1059.006Python 10 Sigma rulesT1059.007JavaScript 26 Sigma rulesT1204.001Malicious Link 4 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1574.001DLL 40 Sigma rules
Persistence
T1098.004SSH Authorized KeysT1112Modify Registry 40 Sigma rulesT1543.003Windows Service 40 Sigma rulesT1547.012Print Processors
Privilege Escalation
Credential Access
Discovery
T1007System Service Discovery 7 Sigma rulesT1016System Network Configuration Discovery 4 Sigma rulesT1018Remote System Discovery 9 Sigma rulesT1033System Owner/User Discovery 26 Sigma rulesT1049System Network Connections Discovery 2 Sigma rulesT1057Process Discovery 3 Sigma rulesT1482Domain Trust Discovery 15 Sigma rules
Lateral Movement
Collection
Command and Control
Exfiltration
Stealth
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗