A sophisticated China-aligned threat actor is using social engineering to carry out cyberespionage and financially motivated attacks, according to researchers at Trend Micro.
“Since mid-2021, we have been investigating a rather elusive threat actor called Earth Lusca that targets organizations globally via a campaign that uses traditional social engineering techniques such as spear phishing and watering holes,” the researchers write. “The group’s primary motivation seems to be cyberespionage: the list of its victims includes high value targets such as government and educational institutions, religious movements, pro-democracy and human rights organizations in Hong Kong, Covid-19 research organizations, and the media, among others. However, the threat actor also seems to be financially motivated, as it also took aim at gambling and cryptocurrency companies.”
The threat actor used spear phishing, watering-hole sites, and website vulnerabilities to compromise its victims.
“The group has three primary attack vectors, two of which involve social engineering,” the researchers write. “The social engineering techniques can be broken down into spear phishing emails and watering hole websites. Our telemetry data shows Earth Lusca sending spear phishing emails containing malicious links to one of their targets — a media company. These links contain files that are disguised either as documents that would be of interest to the potential target, or as opinion forms allegedly coming from another media organization. The user eventually downloads an archive file containing either a malicious LNK file or an executable — eventually leading to a Cobalt Strike loader.”
The threat actor used watering-hole sites to target victims who are interested in certain topics.
“In addition to spear phishing emails, Earth Lusca also made use of watering hole websites — they either compromised websites of their targets or set up fake web pages copied from legitimate websites and then injected malicious JavaScript code inside them,” Trend Micro says. “These links to these websites are then sent to their victims (although we were not able to definitively pinpoint how this was done).”
New-school security awareness training can enable your employees to avoid falling for targeted social engineering attacks.
Trend Micro has the story.
Here's how it works:
