Threadlinqs IntelligenceStart free

Threat actorChinaTracked since 2026-06

Earth Lusca

Also known as:Aquatic PandaHoundstooth TyphoonI-SOONBRONZE UNIVERSITYBountyGladCHROMIUMCharcoal TyphoonControlXFISHMONGERRed Dev 10Red ScyllaRedHotel

As of 2026-09-15, Earth Lusca is a China-nexus threat actor tracked by Threadlinqs Intelligence across 4 threats spanning malware, campaign, vulnerability. Also known as Aquatic Panda, Houndstooth Typhoon, I-SOON, BRONZE UNIVERSITY. ATT&CK coverage spans 97 techniques across 15 tactics in 4 of 4 tracked threats. Most-observed techniques: T1140 (Deobfuscate/Decode Files or Information), T1082 (System Information Discovery), T1190 (Exploit Public-Facing Application).

Tracked threats
41 critical · 2 high · 1 medium
First seen
2026-06-20
Last seen
2026-09-15
ATT&CK techniques
97across 4 of 4 threats
Related CVEs
4Referenced by its activity
Attribution
ChinaNation or origin
Nation: China · 4 tracked threat(s) · Categories: MALWARE, CAMPAIGN, VULNERABILITY

Activity timeline

Earth Lusca appears in 4 tracked threats between and ; the busiest month was 2026-06 with 2 reports.

ATT&CK techniques observed

97 techniques observed across 4 of 4 tracked threats · Stealth (formerly Defense Evasion) (18), Command and Control (13), Discovery (12), Execution (8), Initial Access (7), Persistence (7)
  • T1140 Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion)observed in 4 of 4 tracked threats
  • T1082 System Information Discovery — Discoveryobserved in 3 of 4 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 3 of 4 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 3 of 4 tracked threats
  • T1014 Rootkit — Stealth (formerly Defense Evasion)observed in 2 of 4 tracked threats
  • T1016 System Network Configuration Discovery — Discoveryobserved in 2 of 4 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 2 of 4 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 2 of 4 tracked threats
  • T1055 Process Injection — Stealth (formerly Defense Evasion)observed in 2 of 4 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 2 of 4 tracked threats
  • T1071.001 Web Protocols — Command and Controlobserved in 2 of 4 tracked threats
  • T1083 File and Directory Discovery — Discoveryobserved in 2 of 4 tracked threats
  • T1090 Proxy — Command and Controlobserved in 2 of 4 tracked threats
  • T1105 Ingress Tool Transfer — Command and Controlobserved in 2 of 4 tracked threats
  • T1115 Clipboard Data — Collectionobserved in 2 of 4 tracked threats

Tracked threats

Related CVEs

4 CVEs referenced by tracked Earth Lusca activity