In the ever-evolving landscape of cyber threats, a China-linked cyber espionage actor known as “Earth Lusca” has emerged as a significant player. Since at least 2021, this nefarious group has been actively targeting government organizations in Asia, Latin America, and other regions. By employing sophisticated tactics and exploiting vulnerabilities, Earth Lusca has become a major concern for cybersecurity experts worldwide.
Malware Used: SprySOCKS
At the heart of Earth Lusca’s operations lies their weapon of choice – a Linux backdoor malware called “SprySOCKS.” This malware is a variant of the infamous Trochilus remote access Trojan (RAT), commonly used in Windows environments. However, SprySOCKS brings an unexpected twist by incorporating features from both Trochilus and the Linux version of Derusbi, a RAT that has been employed by advanced persistent threat actors since 2008. Notably, the group’s command-and-control infrastructure resembles that of threat actors associated with the RedLeaves RAT, further complicating attribution efforts.
Functionality of SprySOCKS
SprySOCKS boasts a range of capabilities that allow Earth Lusca to execute their cyber espionage activities effectively. Firstly, it can collect valuable system information, enabling the actors to gain insights into target networks. Additionally, this backdoor malware can initiate an interactive shell, granting unauthorized access to compromised systems. Furthermore, SprySOCKS has the ability to list network connections, allowing Earth Lusca to map out the network architecture of their targets. Finally, the malware can upload and exfiltrate files, giving the threat actors access to sensitive information.
Targeted Organizations
Earth Lusca shows no discrimination when it comes to their targets. Government and educational institutions, pro-democracy and human rights groups, media organizations, and even organizations involved in COVID-19 research have all found themselves on the group’s hit list. By targeting these diverse entities, Earth Lusca showcases the extent of its reach and the broad spectrum of its interests.
Connection to Winnti
While Earth Lusca operates as an independent cyber espionage actor, there are indications that it may be part of the larger Winnti cluster. Winnti is notorious mainly due to its association with Chinese economic objectives and state-sponsored cyber operations. Sharing similarities in targeting and tactics, Earth Lusca’s alignment with Winnti reinforces suspicions of state involvement in its operations.
Tactics Used by Earth Lusca
Earth Lusca employs a range of tactics to infiltrate target networks. Spear-phishing attacks, which involve personalized and deceptive emails, are a common method used by the group. Furthermore, they utilize social engineering scams to exploit human vulnerabilities and gain unauthorized access. Another technique employed is the watering-hole attack, where legitimate and trusted websites are compromised to infect unsuspecting visitors.
Exploitation of “n-day” Vulnerabilities
One area in which Earth Lusca truly excels is exploiting “n-day” vulnerabilities, referring to previously unknown flaws in software applications. The group aggressively targets web-facing applications that may have vulnerabilities yet to be patched or disclosed publicly. By leveraging these vulnerabilities, Earth Lusca gains entry into target networks, allowing them to carry out their espionage activities.
Deployment of Advanced Backdoors
In their pursuit of long-term espionage activities, Earth Lusca deploys advanced backdoors that ensure their persistence in compromised systems. Notably, they utilize backdoors like ShadowPad and the Linux version of Winnti to maintain their access and continue extracting valuable information from compromised networks.
As Earth Lusca continues its cyber espionage activities against government organizations, educational institutions, and various other entities, it serves as a reminder of the ever-present threat faced in today’s interconnected world. The group’s affiliation with Winnti highlights the state-sponsored nature of their operations, emphasizing the importance of vigilance and robust cybersecurity measures. As organizations prioritize protecting their networks and data, they must remain aware of evolving tactics and invest in comprehensive defense strategies to mitigate the risks posed by sophisticated actors like Earth Lusca.