H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

Earth Lusca

[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022) [Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022) [Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)

53 recorded

Relationships

uses
to Archive via Utility
Technique
uses
to Bypass User Account Control
Technique
uses
to certutil
Tool
uses
to Cobalt Strike
Malware
uses
to DCSync
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Domains
Technique
uses
to Domain Trust Discovery
Technique
uses
to Drive-by Compromise
Technique
uses
to Exfiltration to Cloud Storage
Technique
uses
to Exploitation of Remote Services
Technique
uses
to Exploit Public-Facing Application
Technique
uses
to JavaScript
Technique
uses
to LSASS Memory
Technique
uses
to Malicious File
Technique
uses
to Malicious Link
Technique
uses
to Malware
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Mimikatz
Tool
uses
to Modify Registry
Technique
uses
to Mshta
Technique
uses
to NBTscan
Tool
uses
to Nltest
Tool
uses
to Obfuscated Files or Information
Technique
uses
to PowerShell
Technique
uses
to PowerSploit
Tool
uses
to Print Processors
Technique
uses
to Process Discovery
Technique
uses
to Proxy
Technique
uses
to Python
Technique
uses
to Remote System Discovery
Technique
uses
to Scheduled Task
Technique
uses
to Server
Technique
uses
to Server
Technique
uses
to ShadowPad
Malware
uses
to Spearphishing Link
Technique
uses
to SSH Authorized Keys
Technique
uses
to Steganography
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Network Connections Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to System Service Discovery
Technique
uses
to Tasklist
Tool
uses
to Tool
Technique
uses
to Upload Malware
Technique
uses
to Visual Basic
Technique
uses
to Vulnerability Scanning
Technique
uses
to Web Services
Technique
uses
to Web Services
Technique
uses
to Windows Management Instrumentation
Technique
uses
to Windows Service
Technique
uses
to Winnti for Linux
Malware
9 external

References

mitre-attack
G1006
open
Charcoal Typhoon
—
ControlX
—
CHROMIUM
—
TAG-22
—
TrendMicro EarthLusca 2022
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf
open
Recorded Future TAG-22 July 2021
https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan
open
Recorded Future RedHotel August 2023
https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf
open
Microsoft Threat Actor Naming July 2023
https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance