{
  "id": "earth-lusca",
  "name": "Earth Lusca",
  "aliases": [
    "TAG-22",
    "Charcoal Typhoon",
    "CHROMIUM",
    "ControlX"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected China-based group",
      "src": [
        "mitre-g1006"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2019,
      "src": [
        "mitre-g1006"
      ],
      "conf": "medium",
      "note": "At least 2019"
    },
    {
      "k": "attack_id",
      "v": "G1006",
      "src": [
        "mitre-g1006"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States.",
      "src": [
        "mitre-g1006"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 44,
      "src": [
        "mitre-g1006"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "certutil, Cobalt Strike, Mimikatz, NBTscan, Nltest, PowerSploit, ShadowPad, Tasklist, Winnti for Linux",
      "src": [
        "mitre-g1006"
      ],
      "conf": "high",
      "note": "9 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated. Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1006)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/earth-lusca.html",
  "sources": {
    "mitre-g1006": {
      "title": "Earth Lusca, Group G1006",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1006/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}