ChinaAssessedI-SOON contractor teamMixedActive 2019 – 2023Earth Lusca
Also known asTAG-22 · Charcoal Typhoon · CHROMIUM · ControlX · FishMonger · Red Dev 10 · BRONZE UNIVERSITY
Summary
China-based espionage group (MITRE G1006; Trend Micro's Earth Lusca, Recorded Future's TAG-22, Microsoft's Charcoal Typhoon, ESET's FishMonger) that ESET determined is an espionage team operated by the contractor I-SOON (Anxun). DOJ indicted eight I-SOON employees and two MPS officers in Mar 2025 for intrusions from about 2016 to 2023 against the foreign ministries of Taiwan, India, South Korea and Indonesia, US religious and human-rights organisations and news outlets — DOJ does not use the Earth Lusca name, so that link rests on ESET. ESET's Operation FishMedley compromised seven organisations in Taiwan, Hungary, Turkey, Thailand, the US and France between Jan and Oct 2022 with ShadowPad, SodaMaster and Spyder. Trend Micro saw it active through H1 2023 against foreign-affairs, technology and telecom bodies in Southeast Asia, Central Asia and the Balkans, exploiting public-facing servers (Fortinet, Zimbra, GitLab, Exchange ProxyShell, Telerik) and deploying the SprySOCKS Linux backdoor. MITRE lists UAE among historic targets.
Attribution
I-SOON (Anxun) works for PRC security services
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- ESET Research (Research, 2025-03-20)
FishMonger (Earth Lusca) is an espionage team operated by I-SOON - US Department of Justice (Government, 2025-03-05)
Charged I-SOON staff and two Ministry of Public Security officers; the Earth Lusca link is ESET's - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected China-based cyber espionage group
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Public-facing server exploitation and SprySOCKS Linux backdoor | 2023-01 – 2023-06 | Southeast Asia, Central Asia, Balkans | Foreign Affairs, Technology, Telecommunications | Trend Micro (2023-09-18) |
| Operation FishMedley — seven governments, NGOs and think tanks (ShadowPad, SodaMaster, Spyder) | 2022-01 – 2022-10 | Taiwan, Hungary, Turkey, Thailand, USA, France | Government, NGO, Think Tanks | ESET Research (2025-03-20) |
| I-SOON contract intrusions — foreign ministries, religious and human-rights groups, news outlets (DOJ indictment)ASSESSED | 2016 – 2023 | Taiwan, India, South Korea, Indonesia, USA, Hong Kong | Government, Religious, Media, Human Rights | US DOJ (2025-03-05); I-SOON = FishMonger per ESET |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 9
| Resource Development2 | T1584.006Web ServicesT1583.004Server |
|---|---|
| Initial Access2 | T1190Exploit Public-Facing ApplicationT1566.001Spearphishing Attachment |
| Persistence3 | T1505.003Web ShellT1547.012Print ProcessorsT1098.004SSH Authorized Keys |
| Stealth1 | T1027.003Steganography |
| Credential Access1 | T1003.006DCSync |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| ShadowPad | Modular backdoor (shared PRC tool) | Windows |
| SprySOCKS | Linux backdoor | Linux |
| SodaMaster | Backdoor | Windows |
| Spyder | Backdoor | Windows |
| RPipeCommander | Reverse shell | Windows |
| Winnti for Linux | Backdoor | Linux |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2020-1472 | 10 | Netlogon "Zerologon" — privilege escalation (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Lookalike watering-hole domains; compromised servers, GitHub and Google Drive stage malware (MITRE ATT&CK, 2026)
- Cloudflare proxies its compromised servers; separate servers for separate roles (MITRE ATT&CK, 2026)
- Delivery server for Cobalt Strike, Winnti and SprySOCKS; C&C itcom666[.]live (Trend Micro, 2023)