D
CyberChina

Earth Lusca

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: TAG-22, Charcoal Typhoon, CHROMIUM, ControlX

CyberCHN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
Alternative designationsTAG-22, Charcoal Typhoon, CHROMIUM, ControlX
ProliferationOrigin country only
Active since2019At least 2019Med[1]
MITRE ATT&CK IDG1006High[1]
Capabilities
ATT&CK techniques used44ATT&CK v20.1High[1]
Malware and toolscertutil, Cobalt Strike, Mimikatz, NBTscan, Nltest, PowerSploit, ShadowPad, Tasklist, Winnti for Linux9 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorSuspected China-based groupMed[1]
TargetsEarth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States.Med[1]
Notes
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated. Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
China
Sources
  1. Earth Lusca, Group G1006, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1006)