Earth Lusca: China-Linked Cyber-Espionage Actor Targeting Government Organizations and More

In the ever-evolving landscape of cyber threats, a China-linked cyber espionage actor known as “Earth Lusca” has emerged as a significant player. Since at least 2021, this nefarious group has been actively targeting government organizations in Asia, Latin America, and other regions. By employing sophisticated tactics and exploiting vulnerabilities, Earth Lusca has become a major concern for cybersecurity experts worldwide.

Malware Used: SprySOCKS

At the heart of Earth Lusca’s operations lies their weapon of choice – a Linux backdoor malware called “SprySOCKS.” This malware is a variant of the infamous Trochilus remote access Trojan (RAT), commonly used in Windows environments. However, SprySOCKS brings an unexpected twist by incorporating features from both Trochilus and the Linux version of Derusbi, a RAT that has been employed by advanced persistent threat actors since 2008. Notably, the group’s command-and-control infrastructure resembles that of threat actors associated with the RedLeaves RAT, further complicating attribution efforts.

Functionality of SprySOCKS

SprySOCKS boasts a range of capabilities that allow Earth Lusca to execute their cyber espionage activities effectively. Firstly, it can collect valuable system information, enabling the actors to gain insights into target networks. Additionally, this backdoor malware can initiate an interactive shell, granting unauthorized access to compromised systems. Furthermore, SprySOCKS has the ability to list network connections, allowing Earth Lusca to map out the network architecture of their targets. Finally, the malware can upload and exfiltrate files, giving the threat actors access to sensitive information.

Targeted Organizations

Earth Lusca shows no discrimination when it comes to their targets. Government and educational institutions, pro-democracy and human rights groups, media organizations, and even organizations involved in COVID-19 research have all found themselves on the group’s hit list. By targeting these diverse entities, Earth Lusca showcases the extent of its reach and the broad spectrum of its interests.

Connection to Winnti

While Earth Lusca operates as an independent cyber espionage actor, there are indications that it may be part of the larger Winnti cluster. Winnti is notorious mainly due to its association with Chinese economic objectives and state-sponsored cyber operations. Sharing similarities in targeting and tactics, Earth Lusca’s alignment with Winnti reinforces suspicions of state involvement in its operations.

Tactics Used by Earth Lusca

Earth Lusca employs a range of tactics to infiltrate target networks. Spear-phishing attacks, which involve personalized and deceptive emails, are a common method used by the group. Furthermore, they utilize social engineering scams to exploit human vulnerabilities and gain unauthorized access. Another technique employed is the watering-hole attack, where legitimate and trusted websites are compromised to infect unsuspecting visitors.

Exploitation of “n-day” Vulnerabilities

One area in which Earth Lusca truly excels is exploiting “n-day” vulnerabilities, referring to previously unknown flaws in software applications. The group aggressively targets web-facing applications that may have vulnerabilities yet to be patched or disclosed publicly. By leveraging these vulnerabilities, Earth Lusca gains entry into target networks, allowing them to carry out their espionage activities.

Deployment of Advanced Backdoors

In their pursuit of long-term espionage activities, Earth Lusca deploys advanced backdoors that ensure their persistence in compromised systems. Notably, they utilize backdoors like ShadowPad and the Linux version of Winnti to maintain their access and continue extracting valuable information from compromised networks.

As Earth Lusca continues its cyber espionage activities against government organizations, educational institutions, and various other entities, it serves as a reminder of the ever-present threat faced in today’s interconnected world. The group’s affiliation with Winnti highlights the state-sponsored nature of their operations, emphasizing the importance of vigilance and robust cybersecurity measures. As organizations prioritize protecting their networks and data, they must remain aware of evolving tactics and invest in comprehensive defense strategies to mitigate the risks posed by sophisticated actors like Earth Lusca.

Explore more

How Is AI Revolutionizing Payroll in HR Management?

Imagine a scenario where payroll errors cost a multinational corporation millions annually due to manual miscalculations and delayed corrections, shaking employee trust and straining HR resources. This is not a far-fetched situation but a reality many organizations faced before the advent of cutting-edge technology. Payroll, once considered a mundane back-office task, has emerged as a critical pillar of employee satisfaction

AI-Driven B2B Marketing – Review

Setting the Stage for AI in B2B Marketing Imagine a marketing landscape where 80% of repetitive tasks are handled not by teams of professionals, but by intelligent systems that draft content, analyze data, and target buyers with precision, transforming the reality of B2B marketing in 2025. Artificial intelligence (AI) has emerged as a powerful force in this space, offering solutions

5 Ways Behavioral Science Boosts B2B Marketing Success

In today’s cutthroat B2B marketing arena, a staggering statistic reveals a harsh truth: over 70% of marketing emails go unopened, buried under an avalanche of digital clutter. Picture a meticulously crafted campaign—polished visuals, compelling data, and airtight logic—vanishing into the void of ignored inboxes and skipped LinkedIn posts. What if the key to breaking through isn’t just sharper tactics, but

Trend Analysis: Private Cloud Resurgence in APAC

In an era where public cloud solutions have long been heralded as the ultimate destination for enterprise IT, a surprising shift is unfolding across the Asia-Pacific (APAC) region, with private cloud infrastructure staging a remarkable comeback. This resurgence challenges the notion that public cloud is the only path forward, as businesses grapple with stringent data sovereignty laws, complex compliance requirements,

iPhone 17 Series Faces Price Hikes Due to US Tariffs

What happens when the sleek, cutting-edge device in your pocket becomes a casualty of global trade wars? As Apple unveils the iPhone 17 series this year, consumers are bracing for a jolt—not just from groundbreaking technology, but from price tags that sting more than ever. Reports suggest that tariffs imposed by the US on Chinese goods are driving costs upward,