Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Earth Lusca has used

Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1547.012|Print Processors|

Earth Lusca has added the Registry key

Earth Lusca has used PowerShell to execute commands.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Earth Lusca has used

Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Earth Lusca has used

Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1482|Domain Trust Discovery|

Earth Lusca has used

Nltest to obtain information about domain controllers.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,IaaS,Network|T1098.004|SSH Authorized Keys|

Earth Lusca has dropped an SSH-authorized key in the

Earth Lusca has acquired and used a variety of open source tools.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|PRE|T1588.001|Malware|

Earth Lusca has acquired and used a variety of malware, including