threat actor

Earth Lusca

unknownentity:threat_actor

Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated a

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: earth-lusca
kind: threat actor
status: unknown
aliases: AQUATIC PANDA · BountyGlad · BRONZE UNIVERSITY · Charcoal Typhoon · CHROMIUM · ControlX · FISHMONGER · Red Dev 10 · RedHotel · Red Scylla · TAG-22
jurisdictions: —
claims naming it: 0 · 0 attributions · 3 relations · 0 events

Identifiers

attack G1006via mitre-attack
misp-galaxy 39150b30-61af-4d9c-9682-1595e145f3c1via misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatEarth LuscausesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_567btcintel:relations:567@v1 sha256:dfefcde64afa66bc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatEarth LuscausesWinnti for Linux
fetch —sha256 dc1639caa5501d72
rel_568btcintel:relations:568@v1 sha256:582b1d9eaf1f7b9a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatEarth LuscausesShadowPad
fetch —sha256 dc1639caa5501d72
rel_569btcintel:relations:569@v1 sha256:20118d334516fe12
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.