Earth Lusca used Base64 to encode strings.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1595.002|Vulnerability Scanning|

Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1218.005|Mshta|

Earth Lusca has used

Earth Lusca has used

certutil to decode a string into a cabinet file.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Earth Lusca has performed watering hole attacks.(Citation: TrendMicro EarthLusca 2022)|