APT Profile – Earth Lusca

Earth Lusca (aka FishMonger) is a China-linked threat actor active since 2019, that focuses primarily on cyber-espionage against government, media, telecommunications, academic, and religious organizations, while also conducting financially motivated campaigns targeting cryptocurrency platforms. The group leverages tooling and tradecraft like APT41 and the Winnti Group cluster, but is assessed to operate independently from the Winnti Umbrella.

Alias:
FishMonger, Aquatic Panda, BountyGlad, Bronze University, CHROMIUM, Charcoal Typhoon, ControlX, Earth Krahang, RedDev10, RedHotel, RedScylla, and TAG-22.

Motivation:
Information theft, Political espionage, and Financial gain.

Targeted Industries

Targeted Countries:
Southeast Asia, Europe, Selected Middle Eastern targets, South Asia, United States

Target Technologies
Application Frameworks, Linux OS, Office Suite Software, Operating Systems, VPN, Web Applications, Web Servers

Malware used by Earth Lusca:
Spyder, SodaMaster, ShadowPad, XDealer, RESHELL, DinodasRAT (also known as XDealer), and KTLVdoor

Attack flow diagram of APT Threat Actor Earth Lusca

Earth Lusca’s Recent Campaign Highlights and Trends

Recent Campaign Highlights

Deployment of New Backdoors and Malware Evolution:
Recent campaigns show Earth Lusca expanding its malware arsenal with the introduction of KTLVdoor, a highly obfuscated multi-platform backdoor written in Go. The malware can masquerade as legitimate system utilities such as sshd, java, bash, or sqlite and enables attackers to perform remote command execution, port scanning, file manipulation, and system monitoring on both Windows and Linux systems. This development highlights the group’s continued focus on stealth and cross-platform persistence.

Continued Use of Established Espionage Toolsets:
Despite introducing new tools, the group continues to rely heavily on established malware families such as ShadowPad, Winnti, Spyder, and Cobalt Strike to maintain access to compromised environments and conduct data exfiltration. These tools provide modular capabilities, including remote command execution, system reconnaissance, and payload delivery, enabling long-term surveillance operations.

Targeting of Strategic Sectors in Asia:
Earth Lusca’s recent activity shows a continued focus on organizations in government, telecommunications, and technology sectors, particularly within the Asia-Pacific region. These targets are typically associated with sensitive political, economic, or technological information, indicating the group’s strategic objective of intelligence gathering and geopolitical monitoring.

Sophisticated Command-and-Control Infrastructure:
The group maintains a large and dynamic command-and-control (C2) infrastructure, with dozens of servers used to manage infected systems and exfiltrate data. Many of these servers have been observed hosted through cloud providers, allowing the attackers to quickly rotate infrastructure and evade detection by security defenses.

Advanced Obfuscation and Anti-Analysis Techniques:
Recent campaigns emphasize strong code obfuscation, encrypted communications, and disguised binaries to hinder malware analysis and detection. Earth Lusca also strips symbols and renames functions in malware binaries to random strings, making reverse engineering more difficult and extending the operational lifespan of their tools.
 
Persistence and Long-Term Espionage Strategy:
The group’s operations indicate a long-term intelligence-gathering strategy rather than immediate financial gain. By maintaining stealthy persistence within targeted networks and regularly updating their toolset, Earth Lusca is able to conduct prolonged espionage campaigns and continuously collect sensitive information from compromised environments.

Details on Exploited Vulnerabilities

TTPs based on MITRE ATT&CK Framework