Início / Grupos de ameaça / Earth Lusca

Earth Lusca G1006

🔔 Criar alerta

Também conhecido como: TAG-22, Charcoal Typhoon, CHROMIUM, ControlX

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

51

Técnicas

9

Malwares e ferramentas

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2020-1472 Média · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).”

Técnicas por tática

Reconhecimento

T1595.002 Vulnerability Scanning

Desenvolvimento de recursos

T1583.001 Domains T1583.004 Server T1583.006 Web Services T1584.004 Server T1584.006 Web Services T1588.001 Malware T1588.002 Tool T1608.001 Upload Malware

Acesso inicial

T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1204.001 Malicious Link T1204.002 Malicious File T1574.001 DLL

Persistência

T1053.005 Scheduled Task T1098.004 SSH Authorized Keys T1112 Modify Registry T1543.003 Windows Service T1547.012 Print Processors

Escalada de privilégios

T1053.005 Scheduled Task T1098.004 SSH Authorized Keys T1543.003 Windows Service T1547.012 Print Processors T1548.002 Bypass User Account Control

Furtividade

T1027 Obfuscated Files or Information T1027.003 Steganography T1036.005 Match Legitimate Resource Name or Location T1140 Deobfuscate/Decode Files or Information T1218.005 Mshta T1574.001 DLL

Comprometimento de defesas

T1112 Modify Registry

Acesso a credenciais

T1003.001 LSASS Memory T1003.006 DCSync

Descoberta

T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1482 Domain Trust Discovery

Movimento lateral

T1210 Exploitation of Remote Services

Coleta

T1560.001 Archive via Utility

Comando e controle

T1090 Proxy

Exfiltração

T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

Cobalt StrikeMalwareS0154
ShadowPadMalwareS0596
Winnti for LinuxMalwareS0430
certutilFerramentaS0160
MimikatzFerramentaS0002
NBTscanFerramentaS0590
NltestFerramentaS0359
PowerSploitFerramentaS0194
TasklistFerramentaS0057

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.