Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | CHROMIUM |
| OSINT | ControlX |
| OSINT | TAG-22 |
| OSINT | FISHMONGER |
| OSINT | BRONZE UNIVERSITY |
| OSINT | AQUATIC PANDA |
| OSINT | Red Dev 10 |
| OSINT | RedHotel |
| OSINT | Charcoal Typhoon |
| OSINT | BountyGlad |
| OSINT | Red Scylla |
Sectors: Gambling companies, Government Institutions, Education, Media and Entertainment, Pro-democracy and human rights political organizations, Telecommunications, Religious organization, Cryptocurrency, Medical, Covid-19 research organizations
Victim countries: Australia, China, France, Germany, Hong Kong, Japan, Mongolia, Nepal, Nigeria, Philippines, Taiwan, Thailand, United Arab Emirates, United States, Vietnam
Top 20 by how many reports mention them.
Every report in the Global Intel Library that names Earth Lusca, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Earth Lusca. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.