Earth Lusca Threat Actor Profile Guide: Espionage, edge exploits and AI misuse explained

Earth Lusca is a suspected China-based group that breaks in through unpatched internet-facing servers and watering holes, then steals domain credentials to spread, and Microsoft and OpenAI reported in 2024 that the cluster Microsoft calls Charcoal Typhoon had used large language models to support its work. It targets government bodies, telecoms, media, universities, gambling and cryptocurrency firms, and groups that oppose Chinese government policy, across Asia, Europe, Africa and the Americas. This profile covers its names and the alias overlaps you need to understand before reading vendor reports, its targeting, the techniques MITRE ATT&CK records for it, how it abuses credentials, notable reported activity, and the controls that blunt it. It is written for security teams in government, telecoms, higher education, media and political research, and for anyone defending public-facing servers in those sectors. It describes behaviour for defenders only; attribution statements are those of the named sources.

Key takeaways

• Edge servers are the front door. Trend Micro's September 2023 report lists Fortinet, GitLab, Telerik UI, Zimbra and Microsoft Exchange (ProxyShell) flaws among those Earth Lusca exploited, all old, published bugs.
• Domain credentials are the prize after entry. ATT&CK G1006 records LSASS dumping, DCSync and ZeroLogon (CVE-2020-1472) exploitation against domain controllers.
• Names do not line up neatly. ATT&CK lists Charcoal Typhoon and CHROMIUM as aliases of Earth Lusca, while Microsoft maps Charcoal Typhoon to Aquatic Panda, ControlX, RedHotel and BRONZE UNIVERSITY. Treat cross-vendor mappings as approximate.
• AI misuse was reported, not novel tradecraft. On 14 February 2024 Microsoft and OpenAI said Charcoal Typhoon used their services for research, scripting, translation and phishing content, and that the accounts were disabled.
• Patching speed and credential hygiene are the main defences: KEV-driven patching of edge systems, tiered admin accounts, DC monitoring for replication requests and fast web shell hunting.

Who they are (names and aliases)

MITRE ATT&CK (G1006) describes Earth Lusca as a suspected China-based cyber espionage group active since at least April 2019. It notes that the group has used malware common to other Chinese groups, including APT41 and the Winnti Group cluster, but that security researchers assess its techniques and infrastructure as separate. ATT&CK also records that some researchers assess part of its activity as financially motivated.

The practical point: an intelligence report on "Aquatic Panda" or "RedHotel" may describe activity Trend Micro would not call Earth Lusca, and the reverse. Match on behaviours and indicators, not on names. In February 2024 Trend Micro also reported a possible link between Earth Lusca and the Chinese contractor I-Soon, based on a leaked dataset, victim overlap, shared tools such as ShadowPad and Winnti, and a shared location in Chengdu. Trend Micro described this as a lead under investigation, not a confirmed connection. See the Threat Actor Groups Guide and the China State Cyber Operations Guide for how state and contractor activity fits together.

Targeting and motivation

• Geography: ATT&CK lists victims in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France and the United States. Trend Micro's 2023 report says activity in the first half of 2023 concentrated on Southeast Asia, Central Asia and the Balkans, with scattered attacks in Latin America and Africa.
• Sectors: government institutions (Trend Micro highlights foreign affairs, technology and telecoms departments), news media, education, COVID-19 research, telecoms, gambling, cryptocurrency trading platforms and religious movements banned in China.
• Political analysis: Trend Micro's February 2024 report describes a campaign around Taiwan's January 2024 elections using China and Taiwan relations lures against a Taiwan-based academic think tank.
• Microsoft's view of Charcoal Typhoon: government, higher education, communications infrastructure, oil and gas and IT, centred on Taiwan, Thailand, Mongolia, Malaysia, France and Nepal, plus individuals worldwide who oppose China's policies.
• Money as well as intelligence: gambling and cryptocurrency targets are why researchers assess some operations as financially motivated.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 links Earth Lusca to 44 techniques and to software including Cobalt Strike, ShadowPad, Winnti for Linux, Mimikatz and PowerSploit. The selection below focuses on what defenders can detect and prevent. Every technique except T1588.007 is listed against G1006 in ATT&CK v20; T1588.007 is shown as the closest mapping for the AI misuse that Microsoft and OpenAI reported.

Exploited vulnerabilities to check first

Trend Micro presents its list as "including but not limited to" these flaws, and also names a Fortinet FortiNAC issue. After entry the group deployed web shells and Cobalt Strike, and on Linux a backdoor Trend Micro named SprySOCKS. See the Edge Device Exploitation by Threat Actors Guide and the Cobalt Strike Abuse Detection Guide.

How they abuse identities and credentials

Earth Lusca's intrusions turn a single exposed server into domain-wide access by stealing and forging identity material. The chain recorded in ATT&CK and vendor reporting runs as follows.

1. Arrive as the server's own service identity: exploiting Exchange, GitLab or a VPN appliance gives the group whatever the application runs as. On Exchange that is a highly privileged identity in Active Directory. See the Microsoft Exchange Server Security Guide.
2. Harvest cached credentials: dumping LSASS with ProcDump yields hashes and tickets for anyone who has logged on to the host, including administrators who connected to troubleshoot. See the Credential Dumping Guide.
3. Take the directory: ZeroLogon lets an attacker reset a domain controller's machine account, and DCSync then requests password hashes for any account, including krbtgt. See the Golden Ticket, Silver Ticket and DCSync Guide.
4. Plant keys that survive password resets: an SSH authorised key on a Linux server is a non-human credential that a password rotation does not touch. See the SSH Key Management Guide.
5. Abuse trusted cloud accounts: GitHub accounts and compromised Google Drive repositories host payloads, so downloads come from reputable domains.

The AI angle is about the attacker's own accounts, not the victim's: Microsoft and OpenAI disabled the accounts Charcoal Typhoon used. For defenders, that is a reminder that AI services are now part of an adversary's resource development and that phishing and scripts can be produced faster and in better English or other languages. See the AI-Powered Cyber Attacks Guide.

Notable incidents

For a later, deeper case of AI support in espionage, see the Anthropic GTG-1002 campaign breach analysis; that activity was attributed by Anthropic to a different Chinese state-sponsored group, not to Earth Lusca.

Detection and defence

Controls mapped to behaviours

Phased rollout

1. Week 1: check every internet-facing Exchange, Fortinet, GitLab, Zimbra and Telerik-based application against the CVE table above and the KEV catalogue. Anything unpatched is treated as possibly compromised, not just vulnerable: hunt for web shells before patching closes the evidence trail.
2. Weeks 2 to 4: confirm Netlogon secure channel enforcement on all domain controllers, enable LSA protection on servers in a pilot ring first (some third-party authentication packages break), and roll back by removing the RunAsPPL setting if a critical plug-in fails.
3. Month 2: separate administrative tiers so domain admins never log on to internet-facing servers, and rotate service account and krbtgt passwords (twice for krbtgt, with replication time between) if compromise is suspected.
4. Ongoing: subscribe to vendor and government advisories, re-run the edge inventory monthly, and test detections for LSASS access and replication requests.

What to monitor

• Directory replication requests: Event ID 4662 on domain controllers with the replication extended rights GUIDs, from a source that is not a domain controller.
• Netlogon events: Event IDs 5827 to 5831 on domain controllers, which Microsoft added to flag vulnerable Netlogon secure channel connections.
• Web server child processes: w3wp.exe, Java or GitLab processes spawning cmd.exe, PowerShell or certutil.
• New services and print processors: Event ID 7045 and changes under the Print Processors registry key.
• Uploads to MEGA and similar services from servers, which should rarely, if ever, happen.

Metrics

• Median days to patch KEV-listed vulnerabilities on internet-facing systems.
• Percentage of domain controllers and tier 0 servers with LSA protection and Credential Guard enabled.
• Number of privileged accounts that logged on to internet-facing servers in the last 30 days (target: zero).
• Percentage of Linux servers whose authorized_keys files are inventoried and monitored.
• Time from web shell alert to host isolation.

Small organisations, such as think tanks or regional media, gain most by moving mail and collaboration to a maintained cloud service, removing self-hosted edge applications they cannot patch quickly, and using phishing-resistant MFA. Large government and telecoms operators need tiered administration, dedicated DC monitoring and a rehearsed Edge Device Compromise Investigation Playbook.

Common failure patterns

• Patching without hunting: applying a ProxyShell or Fortinet fix months late removes the bug but not the web shell or new accounts already planted.
• Trusting old CVEs are "done": every flaw in Trend Micro's 2023 list was public for months or years before the campaigns.
• Admins logging on to exposed servers: one interactive session leaves credentials in LSASS for the next intruder.
• Resetting passwords but not keys: SSH authorised keys and service account secrets survive a user password reset.
• Reading reports by name only: because Microsoft, Trend Micro and others cluster differently, indicators filed under one name get missed when a report uses another.

Practitioner checklist

• Inventory internet-facing applications and check each against the CVEs above and the CISA KEV catalogue.
• Hunt for web shells and new local or domain accounts on any system that was unpatched while exposed.
• Enforce Netlogon secure channel and enable LSA protection and Credential Guard on servers.
• Alert on directory replication from non-DC sources and on LSASS handle access.
• Keep privileged accounts off internet-facing hosts with tiered administration.
• Inventory and monitor SSH authorised keys, especially for root.
• Block .LNK, .HTA and script attachments and archives containing them at the mail gateway.
• Restrict uploads from servers to unsanctioned cloud storage.
• Map vendor aliases (Earth Lusca, TAG-22, Charcoal Typhoon, CHROMIUM, ControlX) in your threat intelligence platform so indicators are not split.

Standards and references

• MITRE ATT&CK: Earth Lusca (G1006)
• Microsoft Security: Staying ahead of threat actors in the age of AI
• OpenAI: Disrupting malicious uses of AI by state-affiliated threat actors
• Trend Micro: Earth Lusca Employs New Linux Backdoor
• Trend Micro: Earth Lusca Uses Geopolitical Lure to Target Taiwan
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: Obtain Capabilities, Artificial Intelligence (T1588.007)
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Threat Actor Groups Guide · AI-Powered Cyber Attacks Guide · China State Cyber Operations Guide · Edge Device Exploitation by Threat Actors Guide · CISA KEV Catalogue Guide