Earth Lusca
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.
Source-reported aliases: CHROMIUM, ControlX, TAG-22, FISHMONGER, BRONZE UNIVERSITY, AQUATIC PANDA, Red Dev 10, RedHotel, Charcoal Typhoon, BountyGlad, Red Scylla. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Australia · 
China · 
France · 
Germany · 
Hong Kong · 
Japan · 
Mongolia · 
Nepal · 
Nigeria · 
Philippines · 
Taiwan · 
Thailand · 
United Arab Emirates · 
United States of America · 
Vietnam
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf
https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi
https://www.sentinelone.com/wp-content/uploads/2021/08/SentinelOne_-SentinelLabs_ShadowPad_WP_V2.pdf
https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html
https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass
https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf
https://securelist.com/apt-annual-review-2021/105127
https://securelist.com/apt-trends-report-q2-2021/103517
https://www.youtube.com/watch?v=-7Swd1ZetiQ