Earth Lusca: China-Linked Cyber-Espionage Actor Targeting Government Organizations and More

In the ever-evolving landscape of cyber threats, a China-linked cyber espionage actor known as “Earth Lusca” has emerged as a significant player. Since at least 2021, this nefarious group has been actively targeting government organizations in Asia, Latin America, and other regions. By employing sophisticated tactics and exploiting vulnerabilities, Earth Lusca has become a major concern for cybersecurity experts worldwide.

Malware Used: SprySOCKS

At the heart of Earth Lusca’s operations lies their weapon of choice – a Linux backdoor malware called “SprySOCKS.” This malware is a variant of the infamous Trochilus remote access Trojan (RAT), commonly used in Windows environments. However, SprySOCKS brings an unexpected twist by incorporating features from both Trochilus and the Linux version of Derusbi, a RAT that has been employed by advanced persistent threat actors since 2008. Notably, the group’s command-and-control infrastructure resembles that of threat actors associated with the RedLeaves RAT, further complicating attribution efforts.

Functionality of SprySOCKS

SprySOCKS boasts a range of capabilities that allow Earth Lusca to execute their cyber espionage activities effectively. Firstly, it can collect valuable system information, enabling the actors to gain insights into target networks. Additionally, this backdoor malware can initiate an interactive shell, granting unauthorized access to compromised systems. Furthermore, SprySOCKS has the ability to list network connections, allowing Earth Lusca to map out the network architecture of their targets. Finally, the malware can upload and exfiltrate files, giving the threat actors access to sensitive information.

Targeted Organizations

Earth Lusca shows no discrimination when it comes to their targets. Government and educational institutions, pro-democracy and human rights groups, media organizations, and even organizations involved in COVID-19 research have all found themselves on the group’s hit list. By targeting these diverse entities, Earth Lusca showcases the extent of its reach and the broad spectrum of its interests.

Connection to Winnti

While Earth Lusca operates as an independent cyber espionage actor, there are indications that it may be part of the larger Winnti cluster. Winnti is notorious mainly due to its association with Chinese economic objectives and state-sponsored cyber operations. Sharing similarities in targeting and tactics, Earth Lusca’s alignment with Winnti reinforces suspicions of state involvement in its operations.

Tactics Used by Earth Lusca

Earth Lusca employs a range of tactics to infiltrate target networks. Spear-phishing attacks, which involve personalized and deceptive emails, are a common method used by the group. Furthermore, they utilize social engineering scams to exploit human vulnerabilities and gain unauthorized access. Another technique employed is the watering-hole attack, where legitimate and trusted websites are compromised to infect unsuspecting visitors.

Exploitation of “n-day” Vulnerabilities

One area in which Earth Lusca truly excels is exploiting “n-day” vulnerabilities, referring to previously unknown flaws in software applications. The group aggressively targets web-facing applications that may have vulnerabilities yet to be patched or disclosed publicly. By leveraging these vulnerabilities, Earth Lusca gains entry into target networks, allowing them to carry out their espionage activities.

Deployment of Advanced Backdoors

In their pursuit of long-term espionage activities, Earth Lusca deploys advanced backdoors that ensure their persistence in compromised systems. Notably, they utilize backdoors like ShadowPad and the Linux version of Winnti to maintain their access and continue extracting valuable information from compromised networks.

As Earth Lusca continues its cyber espionage activities against government organizations, educational institutions, and various other entities, it serves as a reminder of the ever-present threat faced in today’s interconnected world. The group’s affiliation with Winnti highlights the state-sponsored nature of their operations, emphasizing the importance of vigilance and robust cybersecurity measures. As organizations prioritize protecting their networks and data, they must remain aware of evolving tactics and invest in comprehensive defense strategies to mitigate the risks posed by sophisticated actors like Earth Lusca.

Explore more

Can Federal Lands Power the Future of AI Infrastructure?

I’m thrilled to sit down with Dominic Jainy, an esteemed IT professional whose deep knowledge of artificial intelligence, machine learning, and blockchain offers a unique perspective on the intersection of technology and federal policy. Today, we’re diving into the US Department of Energy’s ambitious plan to develop a data center at the Savannah River Site in South Carolina. Our conversation

Can Your Mouse Secretly Eavesdrop on Conversations?

In an age where technology permeates every aspect of daily life, the notion that a seemingly harmless device like a computer mouse could pose a privacy threat is startling, raising urgent questions about the security of modern hardware. Picture a high-end optical mouse, designed for precision in gaming or design work, sitting quietly on a desk. What if this device,

Building the Case for EDI in Dynamics 365 Efficiency

In today’s fast-paced business environment, organizations leveraging Microsoft Dynamics 365 Finance & Supply Chain Management (F&SCM) are increasingly faced with the challenge of optimizing their operations to stay competitive, especially when manual processes slow down critical workflows like order processing and invoicing, which can severely impact efficiency. The inefficiencies stemming from outdated methods not only drain resources but also risk

Structured Data Boosts AI Snippets and Search Visibility

In the fast-paced digital arena where search engines are increasingly powered by artificial intelligence, standing out amidst the vast online content is a formidable challenge for any website. AI-driven systems like ChatGPT, Perplexity, and Google AI Mode are redefining how information is retrieved and presented to users, moving beyond traditional keyword searches to dynamic, conversational summaries. At the heart of

How Is Oracle Boosting Cloud Power with AMD and Nvidia?

In an era where artificial intelligence is reshaping industries at an unprecedented pace, the demand for robust cloud infrastructure has never been more critical, and Oracle is stepping up to meet this challenge head-on with strategic alliances that promise to redefine its position in the market. As enterprises increasingly rely on AI-driven solutions for everything from data analytics to generative