Earth Lusca
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Earth LuscaOur name
- Charcoal TyphoonMicrosoft
- CHROMIUMMicrosoft
- ControlXMicrosoft
- TAG-22Recorded Future
Targets
Sectors: Government, Telecommunications, Education, Media, Cryptocurrency
Regions: United States, Taiwan, Germany, France, Australia, Vietnam, Hong Kong
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.006DCSync
- T1007System Service Discovery
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1027Obfuscated Files or Information
- T1027.003Steganography
- T1033System Owner/User Discovery
- T1036.005Match Legitimate Resource Name or Location
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1057Process Discovery
- T1059.001PowerShell
- T1059.005Visual Basic
- T1059.006Python
- T1059.007JavaScript
- T1090Proxy
- T1098.004SSH Authorized Keys
- T1112Modify Registry
- T1140Deobfuscate/Decode Files or Information
- T1189Drive-by Compromise
- T1190Exploit Public-Facing Application
- T1204.001Malicious Link
- T1204.002Malicious File
- T1210Exploitation of Remote Services
- T1218.005Mshta
- T1482Domain Trust Discovery
- T1543.003Windows Service
- T1547.012Print Processors
- T1548.002Bypass User Account Control
- T1560.001Archive via Utility
- T1566.002Spearphishing Link
- T1567.002Exfiltration to Cloud Storage
- T1574.001DLL
- T1583.001Domains
- T1583.004Server
- T1583.006Web Services
- T1584.004Server
- T1584.006Web Services
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.