CVE Intelligence
Home / Threat actors / Earth Lusca

Earth Lusca G1006

🔔 Create alert

Also known as: TAG-22, Charcoal Typhoon, CHROMIUM, ControlX

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1
associated CVEs
51
Techniques
9
Malware and tools

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2020-1472 Medium · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability
“Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).”

Techniques by tactic

Reconnaissance
T1595.002 Vulnerability Scanning
Resource Development
T1583.001 DomainsT1583.004 ServerT1583.006 Web ServicesT1584.004 ServerT1584.006 Web ServicesT1588.001 MalwareT1588.002 ToolT1608.001 Upload Malware
Initial Access
T1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1059.006 PythonT1059.007 JavaScriptT1204.001 Malicious LinkT1204.002 Malicious FileT1574.001 DLL
Persistence
T1053.005 Scheduled TaskT1098.004 SSH Authorized KeysT1112 Modify RegistryT1543.003 Windows ServiceT1547.012 Print Processors
Privilege Escalation
T1053.005 Scheduled TaskT1098.004 SSH Authorized KeysT1543.003 Windows ServiceT1547.012 Print ProcessorsT1548.002 Bypass User Account Control
Stealth
T1027 Obfuscated Files or InformationT1027.003 SteganographyT1036.005 Match Legitimate Resource Name or LocationT1140 Deobfuscate/Decode Files or InformationT1218.005 MshtaT1574.001 DLL
Defense Impairment
T1112 Modify Registry
Credential Access
T1003.001 LSASS MemoryT1003.006 DCSync
Discovery
T1007 System Service DiscoveryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1482 Domain Trust Discovery
Lateral Movement
T1210 Exploitation of Remote Services
Collection
T1560.001 Archive via Utility
Command and Control
T1090 Proxy
Exfiltration
T1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.