Loading IOCs…

{'aliases': ['Earth Lusca',
             'TAG-22',
             'Charcoal Typhoon',
             'CHROMIUM',
             'ControlX'],
 'created': '2022-07-01T20:12:30.184Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Earth Lusca](https://attack.mitre.org/groups/G1006) is a '
                'suspected China-based cyber espionage group that has been '
                'active since at least April 2019. [Earth '
                'Lusca](https://attack.mitre.org/groups/G1006) has targeted '
                'organizations in Australia, China, Hong Kong, Mongolia, '
                'Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United '
                'Arab Emirates, Nigeria, Germany, France, and the United '
                'States. Targets included government institutions, news media '
                'outlets, gambling companies, educational institutions, '
                'COVID-19 research organizations, telecommunications '
                'companies, religious movements banned in China, and '
                'cryptocurrency trading platforms; security researchers assess '
                'some [Earth Lusca](https://attack.mitre.org/groups/G1006) '
                'operations may be financially motivated.(Citation: TrendMicro '
                'EarthLusca 2022)\n'
                '\n'
                '[Earth Lusca](https://attack.mitre.org/groups/G1006) has used '
                'malware commonly used by other Chinese threat groups, '
                'including [APT41](https://attack.mitre.org/groups/G0096) and '
                'the [Winnti Group](https://attack.mitre.org/groups/G0044) '
                'cluster, however security researchers assess [Earth '
                "Lusca](https://attack.mitre.org/groups/G1006)'s techniques "
                'and infrastructure are separate.(Citation: TrendMicro '
                'EarthLusca 2022)',
 'external_references': [{'external_id': 'G1006',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G1006'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'Charcoal Typhoon'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'ControlX'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023) (Citation: '
                                         'Recorded Future RedHotel August '
                                         '2023)',
                          'source_name': 'CHROMIUM'},
                         {'description': '(Citation: Recorded Future TAG-22 '
                                         'July 2021)',
                          'source_name': 'TAG-22'},
                         {'description': 'Chen, J., et al. (2022). Delving '
                                         'Deep: An Analysis of Earth Lusca’s '
                                         'Operations. Retrieved July 1, 2022.',
                          'source_name': 'TrendMicro EarthLusca 2022',
                          'url': 'https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf'},
                         {'description': 'INSIKT GROUP. (2021, July 8). '
                                         'Chinese State-Sponsored Activity '
                                         'Group TAG-22 Targets Nepal, the '
                                         'Philippines, and Taiwan Using Winnti '
                                         'and Other Tooling. Retrieved '
                                         'September 16, 2024.',
                          'source_name': 'Recorded Future TAG-22 July 2021',
                          'url': 'https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan'},
                         {'description': 'Insikt Group. (2023, August 8). '
                                         'RedHotel: A Prolific, Chinese '
                                         'State-Sponsored Group Operating at a '
                                         'Global Scale. Retrieved March 11, '
                                         '2024.',
                          'source_name': 'Recorded Future RedHotel August 2023',
                          'url': 'https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf'},
                         {'description': 'Microsoft . (2023, July 12). How '
                                         'Microsoft names threat actors. '
                                         'Retrieved November 17, 2023.',
                          'source_name': 'Microsoft Threat Actor Naming July '
                                         '2023',
                          'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'}],
 'id': 'intrusion-set--cc613a49-9bfa-4e22-98d1-15ffbb03f034',
 'modified': '2025-06-06T14:55:18.144Z',
 'name': 'Earth Lusca',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack', 'mobile-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '2.1'}