Earth Lusca

Earth Lusca, a threat actor believed to be part of the China-backed Winnti collective, has been active since at least 2019 and is known for its cyber-espionage activities. The group primarily targets government organizations in Asia, Latin America, and other regions. Recently, it has expanded its arsenal with a new Linux malware called SprySOCKS, as reported by securityaffairs.com. Researchers from Trend Micro have also discovered Earth Lusca using a multiplatform backdoor named KTLVdoor, which is more complex than tools typically used by this group. It's worth noting that the full extent of infrastructure use by Earth Lusca remains uncertain. In September, researchers revealed an attack on a China-based trading company, attributing it to Earth Lusca. This was based on their ability to tie samples of KTLVdoor to the threat actor with high confidence. However, several other samples of this malware family could not be definitively linked to Earth Lusca. The report also highlighted the unusually large size of the discovered infrastructure, indicating a potentially broad scope of operations. Despite these findings, the exact method of distribution for the new KTLVdoor backdoor by Earth Lusca remains unclear. The cybersecurity community has provided comprehensive lists of indicators of compromise (IOCs) for both Earth Lusca and KTLVdoor, including IP addresses and hashes connected to the campaign. Given the careful measures taken by the malware creators to evade analysis and detection, organizations are advised to stay alert for any signs of compromise by unidentified malware.