UAE targets inside a wide Chinese espionage and for-profit remit.
Also tracked as CHROMIUM · ControlX · TAG-22 · FISHMONGER · BRONZE UNIVERSITY · AQUATIC PANDA · Red Dev 10 · RedHotel · Charcoal Typhoon · BountyGlad · Red Scylla · Aquatic Panda
Summary
Earth Lusca is a threat actor attributed to State-sponsored, I-Soon, assessed as information theft and espionage-motivated. Its recorded targeting runs to gambling companies, government institutions, education, media and entertainment and adjacent sectors across 15 countries in the open reporting we hold — United Arab Emirates among them.
Across 44 attributed ATT&CK techniques we resolve 14 distinct behaviours — the things they do that a detection can be written against. The two that account for most of their observed tradecraft are discovery command burst on one host and valid account abuse or account creation. Their toolkit is 9 named items and not one of them is unique to this actor — everything they are reported to use is sold, published or shared between groups. That makes tooling useless as an identifier here, and the behaviours above carry the whole weight.
For a Gulf defender the relevant line is the victimology: United Arab Emirates appear in the reporting behind this record. That is evidence of past targeting, not a forecast, and it is drawn from what vendors chose to publish — an actor working quietly in a market nobody reports on looks identical to one that is absent.
As MITRE describes them: “Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.” — MITRE ATT&CK, CC BY 4.0.
On the name. “Earth Lusca” labels a cluster of related activity tracked under one name — not a verified organisation. Whether one team, several contractors or a rotating cast sits behind it is not something this record establishes, and the vendor names below are separate groupings that only mostly overlap.
02 — The detection plan
Most actor profiles hand you indicators that expire in days. These are the behaviours the actor cannot drop without changing how they operate, each with the reason it holds. Weight is our own: how much of the actor's observed tradecraft the behaviour accounts for.
The persistence mechanism and the directory it points at both outlive the payload. The discriminator is the TARGET PATH, not the task or key name, which the actor can change freely.
8 techniques · weight 5
The trusted executable is the constant; the dropped library changes every build. Detecting the LOAD relationship survives retooling that every hash and filename rule misses.
6 techniques · weight 5
Few legitimate processes read LSASS memory, so precision is high in most estates once the agents that do are excluded.
2 techniques · weight 5
The delivery wrapper changes constantly; an office, archive or browser process parenting a shell is the same shape across all of them.
8 techniques · weight 5
Defeats egress-domain control outright — the destination is a platform the estate already permits, so no blocklist and no TLD heuristic will see it.
7 techniques · weight 4
Encodes the naming RULE rather than the filenames, so it survives every rename. The convention is a habit; the names are inventory.
6 techniques · weight 4
The command-line SHAPE — the flag combination, not the payload — is stable for months to years and cheap to match.
8 techniques · weight 4
Chosen to avoid a shell, so command-line rules miss it entirely. The broker is a stable choice; what it runs is not.
6 techniques · weight 4
The set of system binaries that can fetch a file is small and changes with the OS, not with the actor.
5 techniques · weight 3
Staging is a step the actor cannot skip, and it happens before the data leaves — the last cheap place to catch it.
7 techniques · weight 3
Not a durable behavioural signature but the entry vector for a large public estate — worth an exposure control even where the detection is weak.
3 techniques · weight 3
The tunneller is a tool choice that persists for months, and the traffic shape is visible even when the payload is not.
8 techniques · weight 3
Produces no malware event at all — the only trace is in identity telemetry, which is why an endpoint-only programme has a blind spot exactly here.
10 techniques · weight 3
No single discovery command is worth an alert. The DENSITY is — several distinct recon binaries on one host inside an hour is a shape ordinary use does not produce.
17 techniques · weight 2
No single behaviour here is worth waking someone. Summed weights of 6 on one host inside a window is an alert; 10 is an incident. The pair that most reliably means this actor rather than commodity crime is Persistence pointing into world-writable staging + Signed binary side-loading an unsigned library — seen together, treat as an incident regardless of total.
03 — Tooling
Purpose is derived, not asserted: each tool's own ATT&CK techniques are resolved to tactics, and the tactics it spends most of its techniques in are what it is for.
Actor-specific means we have no record of it outside this actor's reporting — those are the names that identify them. Commodity covers everything sold, published or shared: Cobalt Strike and Brute Ratel are licensed red-team software every pentester owns, Mimikatz and Impacket are public, and backdoors like ShadowPad circulate between unrelated groups. Finding a commodity tool tells you far less, which is exactly why the split is drawn. ATT&CK's own “malware vs tool” type answers a different question — whether the software is malicious — so it is not used for this.
Commodity and dual-use — 9 items
Moving between hosts and gathering data.
Credential theft and gathering data.
Moving data out and remote control.
Credential theft and moving between hosts.
Remote control and evading defences.
Credential theft and network reconnaissance.
Gathering data and remote control.
We hold none. Our corpus carries 9,780 hashes, but they come from live feeds covering current commodity campaigns — not the decade-old actor-specific backdoors in the list above. ATT&CK itself publishes no sample hashes; it is a technique knowledge base. Where a sample would have to come from a third party’s family tag rather than from this actor’s reporting, we leave the row empty instead of implying an attribution we cannot support.
File hashes — commodity families — 9 held
⚠ These are samples of tools this actor is reported to use, not samples tied to this actor. Cobalt Strike and China Chopper are used by hundreds of groups and by red teams; a match here is evidence about the tool, not about Earth Lusca. Published because a hunt starting point is still worth having, labelled so it cannot be mistaken for attribution.
| Hash | Type | Family | First seen |
|---|---|---|---|
| fe11b199ada23d5ac25efc4215e67f4ff617ccb4d429eb64412072687367ca1c | sha256 | Cobalt Strike | 2026-06-22 |
| ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335 | sha256 | Cobalt Strike | 2026-06-22 |
| eb14d9e35a3bf0a933297f861bee0be9e6b9061fe4573a81ac92b71d55b6474f | sha256 | Cobalt Strike | 2026-06-22 |
| e7aff6a55a7866776272d9913dfbf9d7db33fc9de6aced22f2a195feebb0e85f | sha256 | Cobalt Strike | 2026-06-22 |
| cd99e83d241cfbb41bfcd0bc622a87d16268e710ca7d736d0c5f44774e0056e2 | sha256 | Cobalt Strike | 2026-06-22 |
| c937eca7c4c9b98df9257d986e666d25411aac5fa39d21f7018dd2e1663f0c76 | sha256 | Cobalt Strike | 2026-06-22 |
04 — Coverage, honestly counted
Of the techniques attributed to Earth Lusca, 31 fold into the detection plan above, 9 describe preparation you cannot see from inside your network, and 4 are uncatalogued — we have not yet placed them. That last number is published on purpose; it is the honest size of the gap.
05 — The chain
The same techniques as above, sequenced. Useful for deciding where to spend a detection: the earlier a tactic sits, the more of the intrusion you still get to prevent.
06 — Tradecraft artefacts
Pulled from primary vendor research and kept attributed. These are hunt starting points, not detections — a path an actor used once is worth a query, not a rule.
| Artefact | Kind | First reported by | Date |
|---|---|---|---|
| %programdata%\Microsoft | file path | Eset | 2026-06-16 |
| %public%\log.dll | file path | ESET | 2025-03-20 |
| %public%\music\sam.hive | file path | ESET | 2025-03-20 |
| %public%\music\system.hive | file path | ESET | 2025-03-20 |
| %public%\music\temp.tmp | file path | ESET | 2025-03-20 |
| %public%\task.exe | file path | ESET | 2025-03-20 |
| %systemroot%\Fonts | file path | Eset | 2026-06-16 |
| %systemroot%\Fonts\ | file path | Eset | 2026-06-16 |
| %systemroot%\Fonts\X1B5206BDC1743DD.dat | file path | Eset | 2026-06-16 |
| %windir%\Fonts\KW1B5206BDC1743FP.dat | file path | Eset | 2026-06-16 |
| HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vds.exe | registry | Eset | 2026-06-16 |
| HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vds.exe\debugger | registry | Eset | 2026-06-16 |
07 — Sourcing, graded
NATO Admiralty grading. The letter is the source's reliability, the number the credibility of the claim. We separate primary vendor research from outlets reporting on it, because ten articles derived from one report is one report.
| Grade | Source | Basis |
|---|---|---|
| B2 | MITRE actor record | 29 references across 18 distinct research hosts |
| B2 | Eset | 4 items — primary vendor research |
| C3 | Dark Reading | 3 items — reporting on other vendors' research |
| B2 | Group-IB | 2 items — primary vendor research |
| C3 | The Hacker News | 2 items — reporting on other vendors' research |
| C3 | BleepingComputer | 1 item — reporting on other vendors' research |
| B2 | Trend Micro | 1 item — primary vendor research |
| C4 | otx | 6 indicators; 0 of 6 corroborated by a second source |
| — | Estate telemetry | no data — absent, not negative |
13 items · 6 outlets · 31% of reporting traces to a single outlet
08 — What we do not know
Every vendor profile has these. Most omit them, which leaves you unable to tell a quiet actor from an unobserved one.
No URI paths, headers or beacon sequences for any family we hold. The 6 URLs in our indicator set are unanalysed atomic values, not fingerprints.
No domains are attributed to this actor in our holdings, so no naming convention, TLD preference or hosting pattern can be derived.
09 — Outlook
Probability language is ICD 203. Likelihood and confidence are stated separately: how likely we think it is, and how good our basis is for thinking so.
11 — Related actors
Ranked by shared victimology first, shared attribution second. The reason is on each card.
10 — Primary sources
29 of them. Published in full so the page can be checked rather than believed.
Run it against your own estate
The library is the part we can publish. The platform runs the same detection plan against your own estate, tells you which of these behaviours you already cover, and retro-hunts the rest — on your hardware, with nothing leaving the building.