Loading story…
China-linked threat actor Earth Lusca expanded its operations globally while continuing to concentrate on Southeast Asia, Central Asia, and the Balkans, according to Trend Micro. Researchers recovered and decrypted a previously unseen Linux backdoor dubbed SprySOCKS from the group’s delivery infrastructure, linking it to campaigns targeting government departments involved in foreign affairs as well as organizations in the technology and telecommunications sectors.
Trend Micro said SprySOCKS appears to be a Linux adaptation of the open-source Windows backdoor Trochilus, with an interactive shell resembling Linux Derusbi and a command-and-control protocol similar to RedLeaves RAT. The malware uses a two-part architecture consisting of a loader and an encrypted main payload, and multiple version markers indicate it remains under active development. Investigators also observed Earth Lusca using Cobalt Strike for lateral movement and aggressively exploiting public-facing servers through server-side N-day vulnerabilities to gain access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers obtained an encrypted file from an Earth Lusca delivery server, recovered the original loader from VirusTotal, and decrypted a previously unseen Linux backdoor they named SprySOCKS. The malware was described as a Linux adaptation of the open-source Windows backdoor Trochilus and had only been observed in Earth Lusca operations.
Trend Micro reported that Earth Lusca broadened its operations globally during the first half of 2023, while continuing to focus mainly on Southeast Asia, Central Asia, and the Balkans. Its recent campaigns primarily targeted government departments involved in foreign affairs, technology, and telecommunications.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the China-linked espionage group **FishMonger**—also tracked as **Earth Lusca**, **Aquatic Panda**, **Red Dev 10**, and **TAG-22**—used two previously undocumented Windows variants of the `SprySOCKS` backdoor to target government organizations in Taiwan, Thailand, Pakistan, and Honduras during 2023 and 2024. The malware is described as a Windows evolution of a backdoor previously thought to be Linux-only and has also been linked to the Chengdu-based contractor **iSoon**. Researchers said the implants retained the Linux version’s command-and-control design and encryption while adding Windows-native capabilities and support for TCP, UDP, and WebSocket communications. The two variants, **WIN_DRV** and **WIN_PLUS**, provide more than 30 command-and-control functions, including file and process management, SOCKS proxying, and keylogging. ESET said **WIN_DRV** uses malicious drivers such as `RawWNPF` and `DriverLoader` to hide processes, files, registry keys, and network connections, and to redirect TCP traffic through random ports to mask the real listening port, while **WIN_PLUS** is a simpler backdoor. Investigators also found signs that some intrusions may have involved a UEFI bootkit and possible exploitation of **`CVE-2023-24932`**, a Windows Boot Manager Secure Boot bypass flaw, although the evidence was not strong enough to tie that component to BlackLotus.
Aug 11, 2026
Researchers reported that a cyber-espionage operation targeting government and public-sector organizations in Central Asia, with additional victims in Syria, deployed two newly identified backdoors, **OctLurk** and **SilkLurk**, alongside a proxy implant called **LurkProxy** and post-compromise tools including Impacket `secretsdump`, Browser Password Decryptor, Fscan, WinRAR, 7-Zip, a keylogger, Pandora RC agent, and in one case **PlugX**. The activity, active since January 2025, used victim-specific decryption, in-memory execution, obfuscation, and plugin-based modules to support command execution, file theft, surveillance, credential access, and remote administration, and is assessed with medium confidence to be operated by the same Chinese-speaking threat actor. The campaign appears connected through infrastructure overlap to **MystRodX**, a previously undocumented Linux C++ backdoor delivered by an ELF dropper and initially misclassified as Mirai. MystRodX uses layered encryption, configurable TCP/HTTP communications, and a passive raw-socket “wake-up” mode triggered by crafted DNS or ICMP packets, allowing it to avoid open listening ports; it also maintains persistence through a dual-process guardian mechanism. Prior analysis identified multiple active C2 servers and distinct campaigns tied to separate RSA public keys, and the newly reported overlap with TrustFall, MystRodX, and SilentRaid infrastructure suggests a broader multi-platform espionage ecosystem spanning both Windows and Linux operations.
Jul 31, 2026
Trend Micro reported that the China-aligned threat group **Earth Lusca** targeted organizations in Taiwan with politically themed social-engineering lures tied to cross-strait tensions and the island’s election period. The campaign used documents and decoy content crafted to appear relevant to current geopolitical developments, aiming to entice victims into opening malicious files and initiating compromise. The activity was attributed to a broader cyber-espionage effort focused on Taiwan, with the attackers seeking access to targeted environments for intelligence collection. Trend Micro said the operation reflected Earth Lusca’s established pattern of using timely regional issues to improve phishing success and maintain persistent access against government and other organizations of strategic interest.
Jul 12, 2026