cyber.hendryadrian.com
Security News · cyfirma.com

Earth Lusca Adds Go-Based KTLVdoor Backdoor to Its Espionage Toolkit

· Original article ↗

Summary

CYFIRMA describes Earth Lusca, a China-linked actor active since 2019, as targeting strategic organizations and cryptocurrency platforms. Recent activity includes the Go-based KTLVdoor backdoor, established toolsets and rotating cloud-hosted C2 infrastructure.

Key points

  • Earth Lusca, also known as FishMonger, is described as conducting espionage against government, media, telecommunications, academic and religious organizations, alongside financially motivated campaigns against cryptocurrency platforms.
  • The article describes KTLVdoor as a highly obfuscated Go backdoor that runs on Windows and Linux and can masquerade as sshd, java, bash or sqlite.
  • KTLVdoor capabilities listed include remote command execution, port scanning, file manipulation and system monitoring.
  • Earth Lusca reportedly continues to use ShadowPad, Winnti-family tools, Spyder and Cobalt Strike for access, reconnaissance and data exfiltration.
  • The group is reported to use dozens of cloud-hosted C2 servers and rapid infrastructure rotation to manage infected systems and evade detection.
  • The article lists drive-by compromise, spear-phishing and exploitation of public-facing applications among its reported access methods, citing vulnerabilities including CVE-2024-23897 and CVE-2016-5195.

Article Details

Event Type
Threat profile of Earth Lusca, a China-linked cyber-espionage and financially motivated threat actor.
Impact
Earth Lusca is reported to target government, media, telecommunications, academic, and religious organizations for espionage, and cryptocurrency platforms for financial gain. Its operations use a broad malware toolkit and rotating C2 infrastructure to maintain access and exfiltrate data. The article describes long-term surveillance and potential exposure of sensitive information, but reports no specific victim count or confirmed incident impact.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe article describes strong code obfuscation, encrypted communications, symbol stripping, and function renaming.T1036.005 · Match Legitimate Resource Name or LocationKTLVdoor is reported to masquerade as legitimate system utilities such as sshd, java, bash, or sqlite.T1189 · Drive-by CompromiseThe article says campaigns use drive-by activity.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of public-facing applications, including Jenkins vulnerabilities, for initial access.T1566.002 · Spearphishing LinkThe article says campaigns use spear-phishing links.

CVE

CVE-2016-5195Canonical · Ubuntu linux; Debian · Debian linux; +16 more[CVE IDs ] Exploited/publicly referenced vulnerabilities used for initial access or privilege escalation – CVE-2024-23897 (Jenkins), CVE-2016-5195 (Linux Dirty COW), and other CVEs listed (and 4 more CVEs).CVE-2024-23897jenkins · jenkins; Jenkins Project · Jenkins[CVE IDs ] Exploited/publicly referenced vulnerabilities used for initial access or privilege escalation – CVE-2024-23897 (Jenkins), CVE-2016-5195 (Linux Dirty COW), and other CVEs listed (and 4 more CVEs).

Threat Actors

Aquatic PandaListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.BountyGladListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.Bronze UniversityListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.Charcoal TyphoonListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.chromiumListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.ControlXListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.Earth KrahangListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.Earth LuscaThe article describes Earth Lusca as a China-linked threat actor active since 2019, conducting cyber-espionage and financially motivated campaigns.FishMongerIdentified in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.RedDev10Listed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.RedHotelListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.RedScyllaListed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.TAG-22Listed in the article as an alias of Earth Lusca, which it reports conducts cyber-espionage and financially motivated campaigns.

Malware

DinodasRAT[Malware ] Malware families used in campaigns – KTLVdoor, ShadowPad, and other families including Spyder, SodaMaster, XDealer (DinodasRAT), RESHELL (and 3 more).KTLVdoorcampaigns show expanded tooling and tradecraft — including the new Go-based, multi-platform backdoor KTLVdoor, extensive use of ShadowPad/Winnti toolsets, and a large, cloud-hosted, rotating C2 infrastructure toRESHELL[Malware ] Malware families used in campaigns – KTLVdoor, ShadowPad, and other families including Spyder, SodaMaster, XDealer (DinodasRAT), RESHELL (and 3 more).ShadowPadtooling and tradecraft — including the new Go-based, multi-platform backdoor KTLVdoor, extensive use of ShadowPad/Winnti toolsets, and a large, cloud-hosted, rotating C2 infrastructure to maintain stealth.SodaMaster[Malware ] Malware families used in campaigns – KTLVdoor, ShadowPad, and other families including Spyder, SodaMaster, XDealer (DinodasRAT), RESHELL (and 3 more).SpyderEarth Lusca continues to rely on established toolsets such as ShadowPad, Winnti families, Spyder, and Cobalt Strike for access, reconnaissance, and data exfiltration.Winntiand tradecraft — including the new Go-based, multi-platform backdoor KTLVdoor, extensive use of ShadowPad/Winnti toolsets, and a large, cloud-hosted, rotating C2 infrastructure to maintain stealth.XDealer[Malware ] Malware families used in campaigns – KTLVdoor, ShadowPad, and other families including Spyder, SodaMaster, XDealer (DinodasRAT), RESHELL (and 3 more).

Products

Jenkinssymbol stripping and function renaming, and exploit multiple public vulnerabilities (e.g., Jenkins and Linux CVEs) via drive-by, spear-phishing, and public-facing exploits.LinuxThe group expanded its arsenal with KTLVdoor, a highly obfuscated Go-based, multi-platform backdoor that can masquerade as sshd, java, bash, or sqlite and operate on Windows and Linux.Microsoft WindowsThe group expanded its arsenal with KTLVdoor, a highly obfuscated Go-based, multi-platform backdoor that can masquerade as sshd, java, bash, or sqlite and operate on Windows and Linux.

Tools

Cobalt StrikeEarth Lusca continues to rely on established toolsets such as ShadowPad, Winnti families, Spyder, and Cobalt Strike for access, reconnaissance, and data exfiltration.

Countries

ChinaEarth Lusca (aka FishMonger) is a China-linked threat actor active since 2019 that conducts long‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while alsoUnited StatesOperations concentrate on strategic sectors in the Asia‑Pacific region but also include victims in Europe, the Middle East, South Asia, and the United States.

Industries

Academicsince 2019 that conducts long‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while also running financially motivated campaigns against cryptocurrencyCryptocurrency platformsacademic, and religious organizations while also running financially motivated campaigns against cryptocurrency platforms.Governmentis a China-linked threat actor active since 2019 that conducts long‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while also running financiallyMediaChina-linked threat actor active since 2019 that conducts long‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while also running financially motivatedreligious organizationslong‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while also running financially motivated campaigns against cryptocurrency platforms.TechnologyLusca’s recent activity shows a continued focus on organizations in government, telecommunications, and technology sectors, particularly within the Asia-Pacific region. These targets are typically associated withTelecommunicationsthreat actor active since 2019 that conducts long‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while also running financially motivated campaigns against

Related Articles