Earth Lusca
G10067 reportsAnalyst assessment — key judgments
- Signature techniques: T1059.001 (PowerShell), T1059.007 (JavaScript), T1589.001 (Credentials).
- Primary targeting: US, CN, RU, DE.
- Vulnerabilities exploited: 996 CVE(s) cited across multiple reports (e.g. CVE-2026-81963, CVE-2026-85880, CVE-2026-47297, CVE-2026-50349).
- Activity accelerating: 4 report(s) in last 30d vs 1 prior (+300%).
- Recent movement: 45 new technique(s), 51 new infrastructure indicator(s), 20 new CVE(s) in the last 30 days.
- Hunt coverage 25% of 111 observed techniques (83 gap(s)).
- Assessment confidence: medium (62).
Activity & trend
Movement — last 30 days
Vulnerabilities in this actor's reporting · 1039
- CVE-2026-81963KEV2 rpt
- CVE-2026-85880KEV2 rpt
- CVE-2026-472972 rpt
- CVE-2026-503492 rpt
- CVE-2026-550072 rpt
- CVE-2026-561722 rpt
- CVE-2026-561772 rpt
- CVE-2026-561982 rpt
- CVE-2026-570982 rpt
- CVE-2026-570992 rpt
- CVE-2026-585992 rpt
- CVE-2026-586002 rpt
- CVE-2026-586112 rpt
- CVE-2026-586492 rpt
- CVE-2026-626942 rpt
- CVE-2026-626972 rpt
- CVE-2026-627062 rpt
- CVE-2026-627442 rpt
- CVE-2026-627592 rpt
- CVE-2026-627622 rpt
- CVE-2026-628012 rpt
- CVE-2026-628042 rpt
- CVE-2026-628102 rpt
- CVE-2026-628132 rpt
- CVE-2026-628952 rpt
Overview
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)
Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)
ATT&CK technique matrix
- T1059.001 · PowerShellconf 756
- T1059.007 · JavaScriptconf 704
- T1589.001 · Credentialsconf 704
- T1113 · Screen Captureconf 653
- T1071 · Application Layer Protocolconf 653
- T1036 · Masqueradingconf 653
- T1059 · Command and Scripting Interpreterconf 653
- T1057 · Process Discoveryconf 653
- T1041 · Exfiltration Over C2 Channelconf 653
- T1056 · Input Captureconf 653
- AML.T0050 · Command and Scripting Interpreterconf 653
- AML.T0074 · Masqueradingconf 653
Threat catalogue · engineering roadmap
Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.
Infrastructure
Relationships
Activity
| Title | Source | Severity | Collected |
|---|