LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1006: Earth Lusca

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]

EnterpriseG1006GroupObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Earth Lusca matters because MITRE describes it as a suspected China-based espionage group with broad geographic and sector targeting, including government, media, education, telecommunications, cryptocurrency trading platforms, and COVID-19 research organizations. For leaders, the practical value is not the name itself but whether the organization can recognize the behaviors linked to the group: credential theft, Windows administrative utility abuse, discovery of systems and services, scheduled task persistence/execution, scripting, and use of dual-use or shared tooling such as Cobalt Strike, Mimikatz, PowerSploit, ShadowPad, and Winnti for Linux.

Executive priority

Prioritize this as a resilience and readiness issue for environments with Windows identity infrastructure, sensitive research or regulated data, telecommunications exposure, cryptocurrency operations, or operations in the countries and sectors listed by MITRE. Executives should ask whether SOC and incident response teams can prove visibility into credential-access behaviors such as LSASS access and DCSync, whether administrative tools are baselined well enough to separate normal operations from abuse, and whether audit evidence exists for identity hardening, endpoint logging, and incident containment decision-making.

Technical view

ATT&CK provides no official detection text for Earth Lusca, so defensive validation should be built from the related software and techniques. Focus on Windows identity and endpoint behaviors: Mimikatz and LSASS memory access, DCSync-like domain replication abuse, PowerShell and Visual Basic execution, WMI execution, scheduled task creation, process/service/user/network discovery, and use of native tools such as tasklist, certutil, and nltest. Also account for cross-platform and infrastructure discovery relationships where supplied, including Linux-related tooling such as Winnti for Linux and discovery techniques that include Linux, macOS, ESXi, network devices, and IaaS in their platform scope.

Likely telemetry

  • Endpoint process creation and command-line telemetry for PowerShell, WMI, Visual Basic-related execution, certutil, tasklist, nltest, and scheduled task utilities
  • Windows security events and identity telemetry relevant to LSASS access, privileged logons, domain controller activity, and directory replication-style behavior
  • EDR or host telemetry for credential dumping tools, post-exploitation frameworks, suspicious module loads, memory access, and abnormal parent-child process chains
  • Scheduled task creation, modification, and execution logs
  • Service, process, user, network configuration, and network connection discovery logs from endpoints and servers

Detection direction

  • Do not rely on group-name matching; validate detections against the related behaviors and tools supplied by ATT&CK.
  • Baseline legitimate administrative use of tasklist, certutil, nltest, WMI, PowerShell, and scheduled tasks so detections can distinguish routine administration from unusual execution context, timing, destination, or privilege level.
  • Prioritize high-fidelity detection around credential access: LSASS memory access, known credential dumping behavior, and DCSync-like activity from non-domain-controller or unexpected privileged principals.
  • Correlate discovery behaviors: process, service, user, network configuration, network connection, and remote system discovery occurring in clusters after suspicious execution should raise priority.
  • Tune for shared tooling carefully. Cobalt Strike, Mimikatz, PowerSploit, ShadowPad, and Winnti-related detections can overlap with testing, red-team activity, or other threat groups; require change tickets, approved testing windows, or asset context to reduce false positives.

Mitigation priorities

  • Harden identity first: restrict and monitor privileged accounts, domain replication permissions, and administrative access to systems that can expose credentials.
  • Reduce credential exposure on Windows endpoints and domain controllers through least privilege, administrative tiering, and protection of sensitive authentication material.
  • Constrain and monitor powerful scripting and administration paths such as PowerShell, WMI, scheduled tasks, and certificate utilities without breaking approved operations.
  • Improve endpoint and server logging before relying on analytics: process command lines, script activity, scheduled tasks, service changes, and identity events should be retained and searchable.
  • Maintain tested incident response playbooks for credential theft scenarios, including domain controller review, privileged account reset decisions, and containment of systems showing discovery plus credential-access behavior.
Additional notes and limits

MITRE describes Earth Lusca as suspected China-based and notes overlap in malware commonly used by other Chinese threat groups while also citing researcher assessment that Earth Lusca techniques and infrastructure are separate. This makes attribution-sensitive handling important: use the group context to prioritize hypotheses, but base SOC escalation on observed behavior, affected assets, and confidence in telemetry.

The supplied ATT&CK object has no official detection text, no group-level tactics, and no group-level platforms. The practical guidance here is derived from the official description, aliases, external references, and listed relationships to software and techniques. Local asset exposure, logging quality, approved administrative activity, and incident evidence are required before concluding Earth Lusca-related activity.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Earth Lusca

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

44 rows
DomainIDNameRelationship / procedure
EnterpriseT1583.006Web ServicesSub-technique

Earth Lusca has established GitHub accounts to host their malware.[1]

EnterpriseT1027.003SteganographySub-technique

Earth Lusca has used steganography to hide shellcode in a BMP image file.[1]

EnterpriseT1608.001Upload MalwareSub-technique

Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.[1]

EnterpriseT1098.004SSH Authorized KeysSub-technique

Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.[1]

EnterpriseT1003.006DCSyncSub-technique

Earth Lusca has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.[1]

EnterpriseT1059.005Visual BasicSub-technique

Earth Lusca used VBA scripts.[1]

EnterpriseT1189Drive-by Compromise

Earth Lusca has performed watering hole attacks.[1]

EnterpriseT1018Remote System Discovery

Earth Lusca used the command powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list - property * | findstr “Address”” to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.[1]

EnterpriseT1584.006Web ServicesSub-technique

Earth Lusca has compromised Google Drive repositories.[1]

EnterpriseT1059.007JavaScriptSub-technique

Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.[1]

EnterpriseT1210Exploitation of Remote Services

Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Earth Lusca has used certutil to decode a string into a cabinet file.[1]

EnterpriseT1583.001DomainsSub-technique

Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.[1]

EnterpriseT1033System Owner/User Discovery

Earth Lusca collected information on user accounts via the whoami command.[1]

EnterpriseT1547.012Print ProcessorsSub-technique

Earth Lusca has added the Registry key `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor.[1]

EnterpriseT1059.001PowerShellSub-technique

Earth Lusca has used PowerShell to execute commands.[1]

EnterpriseT1059.006PythonSub-technique

Earth Lusca used Python scripts for port scanning or building reverse shells.[1]

EnterpriseT1057Process Discovery

Earth Lusca has used Tasklist to obtain information from a compromised host.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Earth Lusca used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system for persistence.[1]

EnterpriseT1574.001DLLSub-technique

Earth Lusca has placed a malicious payload in `%WINDIR%\SYSTEM32\oci.dll` so it would be sideloaded by the MSDTC service.[1]

EnterpriseT1112Modify Registry

Earth Lusca modified the registry using the command reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]” for persistence.[1]

EnterpriseT1047Windows Management Instrumentation

Earth Lusca used a VBA script to execute WMI.[1]

EnterpriseT1003.001LSASS MemorySub-technique

Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.[1]

EnterpriseT1218.005MshtaSub-technique

Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.[1]

EnterpriseT1482Domain Trust Discovery

Earth Lusca has used Nltest to obtain information about domain controllers.[1]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.[1]

EnterpriseT1588.002ToolSub-technique

Earth Lusca has acquired and used a variety of open source tools.[1]

EnterpriseT1007System Service Discovery

Earth Lusca has used Tasklist to obtain information from a compromised host.[1]

EnterpriseT1204.002Malicious FileSub-technique

Earth Lusca required users to click on a malicious file for the loader to activate.[1]

EnterpriseT1190Exploit Public-Facing Application

Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.[1]

EnterpriseT1090Proxy

Earth Lusca adopted Cloudflare as a proxy for compromised servers.[1]

EnterpriseT1027Obfuscated Files or Information

Earth Lusca used Base64 to encode strings.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Earth Lusca created a service using the command sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net start SysUpdate for persistence.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.[1]

EnterpriseT1583.004ServerSub-technique

Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.[1]

EnterpriseT1049System Network Connections Discovery

Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational” (Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.[1]

EnterpriseT1595.002Vulnerability ScanningSub-technique

Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.[1]

EnterpriseT1016System Network Configuration Discovery

Earth Lusca used the command ipconfig to obtain information about network configurations.[1]

EnterpriseT1588.001MalwareSub-technique

Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.[1]

EnterpriseT1584.004ServerSub-technique

Earth Lusca has used compromised web servers as part of their operational infrastructure.[1]

EnterpriseT1204.001Malicious LinkSub-technique

Earth Lusca has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.[1]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
ToolEnterprise

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

Windows
ToolEnterprise

S0057: Tasklist

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. [1]

ToolEnterprise

S0160: certutil

certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. [1]

Windows
MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
ToolEnterprise

S0359: Nltest

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.[1]

Windows
MalwareEnterprise

S0596: ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1583.006: Web ServicesEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1027.003: SteganographyEnterpriseuses · TechniqueT1608.001: Upload MalwareEnterpriseuses · TechniqueT1098.004: SSH Authorized KeysEnterpriseuses · TechniqueT1003.006: DCSyncEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1584.006: Web ServicesEnterpriseuses · ToolS0194: PowerSploitEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1210: Exploitation of Remote ServicesEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1583.001: DomainsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · ToolS0057: TasklistEnterpriseuses · TechniqueT1547.012: Print ProcessorsEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1574.001: DLLEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
7e211d515960eef8...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.1Current bundle7e211d515960…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  2. [2]
    CHROMIUM

    (Citation: Microsoft Threat Actor Naming July 2023) (Citation: Recorded Future RedHotel August 2023)

  3. [3]
    CHROMIUM

    (Citation: Microsoft Threat Actor Naming July 2023) (Citation: Recorded Future RedHotel August 2023)

  4. [4]
    CHROMIUM

    (Citation: Microsoft Threat Actor Naming July 2023) (Citation: Recorded Future RedHotel August 2023)

  5. [5]
    Charcoal Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  6. [6]
    Charcoal Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  7. [7]
    Charcoal Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  8. [8]
    ControlX

    (Citation: Microsoft Threat Actor Naming July 2023)

  9. [9]
    ControlX

    (Citation: Microsoft Threat Actor Naming July 2023)

  10. [10]
    ControlX

    (Citation: Microsoft Threat Actor Naming July 2023)

  11. [11]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  12. [12]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  13. [13]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  14. [14]
    Recorded Future RedHotel August 2023

    Insikt Group. (2023, August 8). RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale. Retrieved March 11, 2024.

    Open source URL
  15. [15]
    Recorded Future RedHotel August 2023

    Insikt Group. (2023, August 8). RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale. Retrieved March 11, 2024.

    Open source URL
  16. [16]
    Recorded Future RedHotel August 2023

    Insikt Group. (2023, August 8). RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale. Retrieved March 11, 2024.

    Open source URL
  17. [17]
    Recorded Future TAG-22 July 2021

    INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024.

    Open source URL
  18. [18]
    Recorded Future TAG-22 July 2021

    INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024.

    Open source URL
  19. [19]
    Recorded Future TAG-22 July 2021

    INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024.

    Open source URL
  20. [20]
    TAG-22

    (Citation: Recorded Future TAG-22 July 2021)

  21. [21]
    TAG-22

    (Citation: Recorded Future TAG-22 July 2021)

  22. [22]
    TAG-22

    (Citation: Recorded Future TAG-22 July 2021)

  23. [23]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  24. [24]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  25. [25]
    mitre-attackG1006
    Open source URL
  26. [26]
    mitre-attackG1006
    Open source URL
  27. [27]
    mitre-attackG1006
    Open source URL
  28. [28]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  29. [29]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  30. [30]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  31. [31]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  32. [32]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  33. [33]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  34. [34]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  35. [35]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  36. [36]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  37. [37]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  38. [38]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  39. [39]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  40. [40]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  41. [41]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  42. [42]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  43. [43]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  44. [44]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  45. [45]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  46. [46]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  47. [47]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  48. [48]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  49. [49]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  50. [50]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  51. [51]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  52. [52]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  53. [53]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  54. [54]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  55. [55]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  56. [56]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  57. [57]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  58. [58]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  59. [59]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  60. [60]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  61. [61]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  62. [62]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  63. [63]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  64. [64]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  65. [65]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  66. [66]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  67. [67]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  68. [68]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  69. [69]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  70. [70]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  71. [71]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  72. [72]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  73. [73]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  74. [74]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  75. [75]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  76. [76]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  77. [77]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  78. [78]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  79. [79]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  80. [80]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  81. [81]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  82. [82]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  83. [83]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  84. [84]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  85. [85]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  86. [86]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  87. [87]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  88. [88]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  89. [89]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  90. [90]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  91. [91]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  92. [92]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  93. [93]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  94. [94]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  95. [95]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  96. [96]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  97. [97]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  98. [98]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  99. [99]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  100. [100]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  101. [101]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  102. [102]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  103. [103]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  104. [104]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  105. [105]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  106. [106]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  107. [107]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  108. [108]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  109. [109]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  110. [110]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  111. [111]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  112. [112]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  113. [113]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  114. [114]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  115. [115]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  116. [116]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  117. [117]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  118. [118]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  119. [119]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  120. [120]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  121. [121]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  122. [122]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  123. [123]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  124. [124]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use