Earth Lusca

Earth Lusca, a threat actor identified as being Chinese-speaking, has been active since at least the first half of 2023. The group primarily targets organizations in Southeast Asia, Central Asia, and the Balkans. Recently, it has expanded its arsenal with SprySOCKS Linux malware, a new addition that poses a significant threat to cybersecurity. This move was reported by security affairs, highlighting the increasing sophistication and adaptability of Earth Lusca's operations. The group has also been linked with high confidence to the usage of KTLVdoor, a multiplatform backdoor malware. This was discovered by Trend Micro researchers who noted an attack against a trading company in China where this new backdoor was used. However, several other samples of this malware family could not be definitively tied to Earth Lusca, indicating potential operational diversity or collaboration with other threat actors. The size of the infrastructure that has been discovered associated with Earth Lusca is unusually large, further underscoring the scale and potential impact of their activities. Despite these findings, it remains unclear how Earth Lusca distributes the new backdoor KTLVdoor. This lack of clarity presents a challenge for cybersecurity efforts, as understanding distribution methods is crucial for effective prevention and response strategies. As such, further investigation into Earth Lusca's tactics and techniques is necessary to mitigate future threats. The reports have provided Indicators of Compromise (IoCs) which can aid in detection and prevention of these threats.