Cyber Resilience

Threat actor · all actors

Aquatic PandaG0143 state

🇨🇳 CN

aka Aquatic Panda, Earth Lusca, CHROMIUM, ControlX, TAG-22, FISHMONGER, BRONZE UNIVERSITY, Red Dev 10, RedHotel, Charcoal Typhoon, BountyGlad, Red Scylla

Last updated: 2026-08-22

1attributed CVEs
49ATT&CK techniques
1.2IDF score (tooling uniqueness)
0exclusive CVEs
2026years active

About this actor

Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0143

Microsoftweather-system names

Charcoal Typhoon

CrowdStrikenation-animal names

Aquatic Panda

Secureworkscolour-metal names

BRONZE UNIVERSITY

Recorded FutureTAG id

TAG-22

Unclassifiedno scheme matched

Earth LuscaCHROMIUMControlXFISHMONGERRed Dev 10RedHotelBountyGladRed Scylla

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 49 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2026-20929 5.97.50.01162026-01-13see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-431 / 4963%
CM-630 / 4961%
AC-228 / 4957%
AC-328 / 4957%
AC-628 / 4957%
CM-226 / 4953%
SI-323 / 4947%
AC-521 / 4943%
CM-720 / 4941%
SI-720 / 4941%
CM-518 / 4937%
IA-218 / 4937%
CA-716 / 4933%
RA-513 / 4927%
SI-1013 / 4927%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category