Earth Lusca is a suspected China-based group that breaks in through unpatched internet-facing servers and watering holes, then steals domain credentials to spread, and Microsoft and OpenAI reported in 2024 that the cluster Microsoft calls Charcoal Typhoon had used large language models to support its work. It targets government bodies, telecoms, media, universities, gambling and cryptocurrency firms, and groups that oppose Chinese government policy, across Asia, Europe, Africa and the Americas. This profile covers its names and the alias overlaps you need to understand before reading vendor reports, its targeting, the techniques MITRE ATT&CK records for it, how it abuses credentials, notable reported activity, and the controls that blunt it. It is written for security teams in government, telecoms, higher education, media and political research, and for anyone defending public-facing servers in those sectors. It describes behaviour for defenders only; attribution statements are those of the named sources.
Key takeaways
- Edge servers are the front door. Trend Micro's September 2023 report lists Fortinet, GitLab, Telerik UI, Zimbra and Microsoft Exchange (ProxyShell) flaws among those Earth Lusca exploited, all old, published bugs.
- Domain credentials are the prize after entry. ATT&CK G1006 records LSASS dumping, DCSync and ZeroLogon (CVE-2020-1472) exploitation against domain controllers.
- Names do not line up neatly. ATT&CK lists Charcoal Typhoon and CHROMIUM as aliases of Earth Lusca, while Microsoft maps Charcoal Typhoon to Aquatic Panda, ControlX, RedHotel and BRONZE UNIVERSITY. Treat cross-vendor mappings as approximate.
- AI misuse was reported, not novel tradecraft. On 14 February 2024 Microsoft and OpenAI said Charcoal Typhoon used their services for research, scripting, translation and phishing content, and that the accounts were disabled.
- Patching speed and credential hygiene are the main defences: KEV-driven patching of edge systems, tiered admin accounts, DC monitoring for replication requests and fast web shell hunting.
Who they are (names and aliases)
MITRE ATT&CK (G1006) describes Earth Lusca as a suspected China-based cyber espionage group active since at least April 2019. It notes that the group has used malware common to other Chinese groups, including APT41 and the Winnti Group cluster, but that security researchers assess its techniques and infrastructure as separate. ATT&CK also records that some researchers assess part of its activity as financially motivated.
| Name | Used by | Notes |
|---|---|---|
| Earth Lusca (G1006) | Trend Micro, MITRE ATT&CK | Primary ATT&CK name |
| TAG-22 | Recorded Future; listed in ATT&CK | Associated group in G1006 |
| Charcoal Typhoon, CHROMIUM | Microsoft (current and former names); listed in ATT&CK | Microsoft calls it a Chinese state-affiliated actor with broad operational scope |
| ControlX | Listed in ATT&CK and by Microsoft | Vendor name |
| Aquatic Panda, RedHotel, BRONZE UNIVERSITY | Named by Microsoft as other researchers' names for Charcoal Typhoon | Not listed as aliases in ATT&CK G1006; other vendors may track these as distinct clusters |
The practical point: an intelligence report on "Aquatic Panda" or "RedHotel" may describe activity Trend Micro would not call Earth Lusca, and the reverse. Match on behaviours and indicators, not on names. In February 2024 Trend Micro also reported a possible link between Earth Lusca and the Chinese contractor I-Soon, based on a leaked dataset, victim overlap, shared tools such as ShadowPad and Winnti, and a shared location in Chengdu. Trend Micro described this as a lead under investigation, not a confirmed connection. See the Threat Actor Groups Guide and the China State Cyber Operations Guide for how state and contractor activity fits together.
Targeting and motivation
- Geography: ATT&CK lists victims in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France and the United States. Trend Micro's 2023 report says activity in the first half of 2023 concentrated on Southeast Asia, Central Asia and the Balkans, with scattered attacks in Latin America and Africa.
- Sectors: government institutions (Trend Micro highlights foreign affairs, technology and telecoms departments), news media, education, COVID-19 research, telecoms, gambling, cryptocurrency trading platforms and religious movements banned in China.
- Political analysis: Trend Micro's February 2024 report describes a campaign around Taiwan's January 2024 elections using China and Taiwan relations lures against a Taiwan-based academic think tank.
- Microsoft's view of Charcoal Typhoon: government, higher education, communications infrastructure, oil and gas and IT, centred on Taiwan, Thailand, Mongolia, Malaysia, France and Nepal, plus individuals worldwide who oppose China's policies.
- Money as well as intelligence: gambling and cryptocurrency targets are why researchers assess some operations as financially motivated.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 links Earth Lusca to 44 techniques and to software including Cobalt Strike, ShadowPad, Winnti for Linux, Mimikatz and PowerSploit. The selection below focuses on what defenders can detect and prevent. Every technique except T1588.007 is listed against G1006 in ATT&CK v20; T1588.007 is shown as the closest mapping for the AI misuse that Microsoft and OpenAI reported.
| Tactic | Technique | How it shows up |
|---|---|---|
| Reconnaissance | T1595.002 Vulnerability Scanning | Scanning targets' public-facing servers for known flaws |
| Resource development | T1583.001 Domains; T1583.006 Web Services; T1584.004 Server | Look-alike domains for watering holes; GitHub accounts and compromised web servers hosting malware |
| Resource development | T1588.007 Artificial Intelligence (closest mapping, not in G1006) | LLM use for research, scripting and translation reported in February 2024 |
| Initial access | T1190 Exploit Public-Facing Application | Exchange, Oracle GlassFish and, per Trend Micro, Fortinet, GitLab, Telerik and Zimbra flaws |
| Initial access | T1189 Drive-by Compromise; T1566.002 Spearphishing Link | Injected JavaScript on legitimate sites; links to decoy documents with loaders |
| Execution | T1059.001 PowerShell; T1218.005 Mshta; T1047 WMI | Scripted execution, HTA scripts launched from .LNK files |
| Persistence | T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.012 Print Processors; T1098.004 SSH Authorized Keys | Tasks and services named like updates; a malicious print processor DLL; an SSH key in /root/.ssh |
| Privilege escalation | T1548.002 Bypass User Account Control | Fodhelper UAC bypass |
| Stealth | T1574.001 DLL; T1036.005 Match Legitimate Resource Name; T1027.003 Steganography | Side-loaded DLLs, files placed in system paths, shellcode hidden in a BMP |
| Credential access | T1003.001 LSASS Memory; T1003.006 DCSync | ProcDump against LSASS; Mimikatz DCSync from a compromised controller |
| Discovery | T1482 Domain Trust Discovery; T1049 System Network Connections Discovery | Nltest for domain controllers; parsing RDP client logs to map connections |
| Lateral movement | T1210 Exploitation of Remote Services | ZeroLogon (CVE-2020-1472) against a domain controller |
| Command and control | T1090 Proxy | Cloudflare used as a proxy for compromised servers |
| Exfiltration | T1560.001 Archive via Utility; T1567.002 Exfiltration to Cloud Storage | WinRAR archives uploaded to MEGA |
Exploited vulnerabilities to check first
| CVE | Product | CISA KEV status |
|---|---|---|
| CVE-2022-40684 | Fortinet FortiOS, FortiProxy, FortiSwitchManager authentication bypass | In KEV since 11 October 2022 |
| CVE-2021-22205 | GitLab CE/EE remote code execution | In KEV since 3 November 2021 |
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX deserialisation | In KEV since 3 November 2021 |
| CVE-2019-9670, CVE-2019-9621 | Zimbra Collaboration Suite | CVE-2019-9670 in KEV since 10 January 2022 |
| CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Microsoft Exchange (ProxyShell) | CVE-2021-34473 in KEV since 3 November 2021 |
| CVE-2020-1472 | Netlogon (ZeroLogon), used after entry | In KEV since 3 November 2021 |
Trend Micro presents its list as "including but not limited to" these flaws, and also names a Fortinet FortiNAC issue. After entry the group deployed web shells and Cobalt Strike, and on Linux a backdoor Trend Micro named SprySOCKS. See the Edge Device Exploitation by Threat Actors Guide and the Cobalt Strike Abuse Detection Guide.
How they abuse identities and credentials
Earth Lusca's intrusions turn a single exposed server into domain-wide access by stealing and forging identity material. The chain recorded in ATT&CK and vendor reporting runs as follows.
- Arrive as the server's own service identity: exploiting Exchange, GitLab or a VPN appliance gives the group whatever the application runs as. On Exchange that is a highly privileged identity in Active Directory. See the Microsoft Exchange Server Security Guide.
- Harvest cached credentials: dumping LSASS with ProcDump yields hashes and tickets for anyone who has logged on to the host, including administrators who connected to troubleshoot. See the Credential Dumping Guide.
- Take the directory: ZeroLogon lets an attacker reset a domain controller's machine account, and DCSync then requests password hashes for any account, including
krbtgt. See the Golden Ticket, Silver Ticket and DCSync Guide. - Plant keys that survive password resets: an SSH authorised key on a Linux server is a non-human credential that a password rotation does not touch. See the SSH Key Management Guide.
- Abuse trusted cloud accounts: GitHub accounts and compromised Google Drive repositories host payloads, so downloads come from reputable domains.
The AI angle is about the attacker's own accounts, not the victim's: Microsoft and OpenAI disabled the accounts Charcoal Typhoon used. For defenders, that is a reminder that AI services are now part of an adversary's resource development and that phishing and scripts can be produced faster and in better English or other languages. See the AI-Powered Cyber Attacks Guide.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| Since at least April 2019 | Earliest activity recorded for the group | MITRE ATT&CK G1006 |
| 2022 | Trend Micro technical paper "Delving Deep: An Analysis of Earth Lusca's Operations" describing watering holes, spear phishing and public-facing server exploitation, with Cobalt Strike, ShadowPad and Winnti | Trend Micro, cited in ATT&CK |
| First half of 2023 | Campaigns against government foreign affairs, technology and telecoms departments; SprySOCKS Linux backdoor found on a delivery server | Trend Micro, 18 September 2023 |
| December 2023 to January 2024 | Taiwan election period lures (archive titled on China's "gray zone warfare" against Taiwan) delivering Cobalt Strike through .LNK files and DLL side-loading | Trend Micro, February 2024, high confidence attribution |
| 14 February 2024 | Microsoft and OpenAI disclose and disable accounts used by Charcoal Typhoon and four other state-affiliated actors | Microsoft Security blog; OpenAI |
For a later, deeper case of AI support in espionage, see the Anthropic GTG-1002 campaign breach analysis; that activity was attributed by Anthropic to a different Chinese state-sponsored group, not to Earth Lusca.
Detection and defence
Controls mapped to behaviours
| Behaviour | Control | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|---|
| Exploiting known edge flaws (T1190) | Patch KEV-listed internet-facing systems first, with an external attack surface inventory | RA-5, SI-2, SA-22 | ID.RA-01, PR.PS-02 |
| Web shells after exploitation (T1505.003) | File integrity monitoring on web roots; alert on web server processes spawning shells | SI-4, SI-7 | DE.CM-09 |
| LSASS dumping (T1003.001) | Credential Guard, LSA protection, and alerts on handles to lsass.exe | AC-6, SI-4 | PR.AA-05 |
| DCSync and ZeroLogon (T1003.006, T1210) | Netlogon enforcement mode; alert on directory replication from non-DC hosts | SI-2, AU-6 | DE.AE-02 |
| SSH key persistence (T1098.004) | Central inventory of authorized_keys; alert on changes for root | AC-2, IA-5 | PR.AA-05 |
| Watering holes and spear phishing (T1189, T1566.002) | Block .LNK, .HTA and script files from mail and archives; browser isolation for high-risk users | SC-7, CM-7 | PR.PS-01 |
| Cloud storage exfiltration (T1567.002) | Block or alert on uploads to unsanctioned file-sharing services such as MEGA | SC-7 | DE.CM-01 |
Phased rollout
- Week 1: check every internet-facing Exchange, Fortinet, GitLab, Zimbra and Telerik-based application against the CVE table above and the KEV catalogue. Anything unpatched is treated as possibly compromised, not just vulnerable: hunt for web shells before patching closes the evidence trail.
- Weeks 2 to 4: confirm Netlogon secure channel enforcement on all domain controllers, enable LSA protection on servers in a pilot ring first (some third-party authentication packages break), and roll back by removing the
RunAsPPLsetting if a critical plug-in fails. - Month 2: separate administrative tiers so domain admins never log on to internet-facing servers, and rotate service account and
krbtgtpasswords (twice forkrbtgt, with replication time between) if compromise is suspected. - Ongoing: subscribe to vendor and government advisories, re-run the edge inventory monthly, and test detections for LSASS access and replication requests.
What to monitor
- Directory replication requests: Event ID 4662 on domain controllers with the replication extended rights GUIDs, from a source that is not a domain controller.
- Netlogon events: Event IDs 5827 to 5831 on domain controllers, which Microsoft added to flag vulnerable Netlogon secure channel connections.
- Web server child processes:
w3wp.exe, Java or GitLab processes spawningcmd.exe, PowerShell orcertutil. - New services and print processors: Event ID 7045 and changes under the Print Processors registry key.
- Uploads to MEGA and similar services from servers, which should rarely, if ever, happen.
Metrics
- Median days to patch KEV-listed vulnerabilities on internet-facing systems.
- Percentage of domain controllers and tier 0 servers with LSA protection and Credential Guard enabled.
- Number of privileged accounts that logged on to internet-facing servers in the last 30 days (target: zero).
- Percentage of Linux servers whose
authorized_keysfiles are inventoried and monitored. - Time from web shell alert to host isolation.
Small organisations, such as think tanks or regional media, gain most by moving mail and collaboration to a maintained cloud service, removing self-hosted edge applications they cannot patch quickly, and using phishing-resistant MFA. Large government and telecoms operators need tiered administration, dedicated DC monitoring and a rehearsed Edge Device Compromise Investigation Playbook.
Common failure patterns
- Patching without hunting: applying a ProxyShell or Fortinet fix months late removes the bug but not the web shell or new accounts already planted.
- Trusting old CVEs are "done": every flaw in Trend Micro's 2023 list was public for months or years before the campaigns.
- Admins logging on to exposed servers: one interactive session leaves credentials in LSASS for the next intruder.
- Resetting passwords but not keys: SSH authorised keys and service account secrets survive a user password reset.
- Reading reports by name only: because Microsoft, Trend Micro and others cluster differently, indicators filed under one name get missed when a report uses another.
Practitioner checklist
- Inventory internet-facing applications and check each against the CVEs above and the CISA KEV catalogue.
- Hunt for web shells and new local or domain accounts on any system that was unpatched while exposed.
- Enforce Netlogon secure channel and enable LSA protection and Credential Guard on servers.
- Alert on directory replication from non-DC sources and on LSASS handle access.
- Keep privileged accounts off internet-facing hosts with tiered administration.
- Inventory and monitor SSH authorised keys, especially for root.
- Block .LNK, .HTA and script attachments and archives containing them at the mail gateway.
- Restrict uploads from servers to unsanctioned cloud storage.
- Map vendor aliases (Earth Lusca, TAG-22, Charcoal Typhoon, CHROMIUM, ControlX) in your threat intelligence platform so indicators are not split.
Standards and references
- MITRE ATT&CK: Earth Lusca (G1006)
- Microsoft Security: Staying ahead of threat actors in the age of AI
- OpenAI: Disrupting malicious uses of AI by state-affiliated threat actors
- Trend Micro: Earth Lusca Employs New Linux Backdoor
- Trend Micro: Earth Lusca Uses Geopolitical Lure to Target Taiwan
- CISA: Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK: Obtain Capabilities, Artificial Intelligence (T1588.007)
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Threat Actor Groups Guide · AI-Powered Cyber Attacks Guide · China State Cyber Operations Guide · Edge Device Exploitation by Threat Actors Guide · CISA KEV Catalogue Guide