Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections
Tags
cmtmf-attack-pattern: Command And Scripting Interpreter Masquerading Obfuscated Files Or Information
country: China Taiwan
maec-delivery-vectors: Watering Hole
attack-pattern: Data Command And Scripting Interpreter - T1623 Dll Search Order Hijacking - T1574.001 Double File Extension - T1036.007 Embedded Payloads - T1027.009 Encrypted Channel - T1521 Encrypted Channel - T1573 Exfiltration Over C2 Channel - T1646 File And Directory Discovery - T1420 Hidden Files And Directories - T1564.001 Hijack Execution Flow - T1625 Hijack Execution Flow - T1574 Ip Addresses - T1590.005 Javascript - T1059.007 Lnk Icon Smuggling - T1027.012 Malicious File - T1204.002 Malicious Link - T1204.001 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Obfuscated Files Or Information - T1406 Phishing - T1660 Phishing - T1566 Server - T1583.004 Server - T1584.004 Software - T1592.002 Software Packing - T1027.002 Software Packing - T1406.002 Spearphishing Link - T1566.002 Windows Command Shell - T1059.003 Tool - T1588.002 Command-Line Interface - T1059 Data Encoding - T1132 Data Obfuscation - T1001 Deobfuscate/Decode Files Or Information - T1140 Dll Search Order Hijacking - T1038 Exfiltration Over Command And Control Channel - T1041 File And Directory Discovery - T1083 Hidden Files And Directories - T1158 Indirect Command Execution - T1202 Masquerading - T1036 Obfuscated Files Or Information - T1027 Software Packing - T1045 User Execution - T1204 Masquerading User Execution
Show in Graph
Common Information
Type Value
UUID 8617d9d2-0366-4012-9b5a-5ee177ae17fd
Fingerprint b454881124b5ff80
Analysis status IN_PROGRESS
Considered CTI value 2
Text language
Published Feb. 26, 2024, midnight
Added to db Oct. 15, 2024, 4:18 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections
Title Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections
Detected Hints/Tags/Attributes 113/4/32
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_nz/research/24/b/earth-lusca-uses-geopolitical-lure-to-target-taiwan.html
Details Source https://www.trendmicro.com/en_my/research/24/b/earth-lusca-uses-geopolitical-lure-to-target-taiwan.html
Details Source https://www.trendmicro.com/en_sg/research/24/b/earth-lusca-uses-geopolitical-lure-to-target-taiwan.html
Details Source https://www.trendmicro.com/en_au/research/24/b/earth-lusca-uses-geopolitical-lure-to-target-taiwan.html
Details Source https://www.trendmicro.com/en_in/research/24/b/earth-lusca-uses-geopolitical-lure-to-target-taiwan.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details Domain 2 
upserver.updateservice.store
Details Domain 2 
www.cybereason.xyz
Details Domain 2 
updateservice.store
Details Domain 2 
cybereason.xyz
Details File 2 
taiwan.7z
Details File 2 
cat.js
Details File 1260 
explorer.exe
Details File 226 
certutil.exe
Details File 32 
expand.exe
Details File 17 
360se.exe
Details File 2 
pfexec.exe
Details File 15 
chrome_elf.dll
Details File 2 
common.html
Details File 2 
ppt-cih1w4.7z
Details MITRE ATT&CK Techniques 183 
T1566.002
Details MITRE ATT&CK Techniques 333 
T1059.003
Details MITRE ATT&CK Techniques 93 
T1059.007
Details MITRE ATT&CK Techniques 106 
T1204.001
Details MITRE ATT&CK Techniques 365 
T1204.002
Details MITRE ATT&CK Techniques 504 
T1140
Details MITRE ATT&CK Techniques 94 
T1564.001
Details MITRE ATT&CK Techniques 70 
T1574.001
Details MITRE ATT&CK Techniques 60 
T1202
Details MITRE ATT&CK Techniques 19 
T1036.007
Details MITRE ATT&CK Techniques 160 
T1027.002
Details MITRE ATT&CK Techniques 40 
T1027.009
Details MITRE ATT&CK Techniques 6 
T1027.012
Details MITRE ATT&CK Techniques 585 
T1083
Details MITRE ATT&CK Techniques 96 
T1132
Details MITRE ATT&CK Techniques 75 
T1001
Details MITRE ATT&CK Techniques 163 
T1573
Details MITRE ATT&CK Techniques 422 
T1041