Loading threat actor…
Earth Lusca is a China-linked cyberespionage threat actor also tracked as Aquatic Panda, Bronze University, Charcoal Typhoon, Chromium, ControlX, FishMonger, RedHotel, and TAG-22. It is assessed to operate within the broader APT41 ecosystem. Its targets include government organizations, with documented activity against government entities in Taiwan, Thailand, Pakistan, and Honduras during 2023–2024. Its broader targeting footprint extends across Asia, the Americas, Europe, and other regions. The actor's tooling includes the SprySOCKS and KTLVdoor backdoors, and ShadowPad samples have also been associated with its activity. Its techniques include DLL sideloading and OLLVM-based obfuscation to conceal malicious code and complicate analysis. Earth Lusca shares infrastructure and malware characteristics with Earth Krahang, but the two are tracked separately because of differences in their initial-stage backdoors and infrastructure.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
176 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
37 malware families Mallory has associated with this actor across public reporting.
32 additional families tracked in Mallory.
27 CVEs Mallory has associated with this actor across public reporting. 27 of them are exploited in the wild (not necessarily by this actor).
21 more CVEs tied to this actor tracked in Mallory.
119 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.