FishMonger
MITRE G1010Also known as Earth Lusca, TAG-22, Aquatic Panda, Red Dev 10, Bronze University, Charcoal Typhoon, RedHotel
Reports
5
First seen
Jan 26, 2026
Last seen
Jun 16, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1071.001 Application Layer Protocol: Web Protocols ×4T1082 System Information Discovery ×3T1053.005 Scheduled Task/Job: Scheduled Task ×3T1059.003 Command and Scripting Interpreter: Windows Command Shell ×2T1547.012 Boot or Logon Autostart Execution: Print Processors ×2T1562.001 Impair Defenses: Disable or Modify Tools ×2T1057 Process Discovery ×2T1014 Rootkit ×2T1608.002 Stage Capabilities: Upload Tool ×1T1102.002 Web Service: Bidirectional Communication ×1T1112 Modify Registry ×1T1059.007 JavaScript/JScript ×1
Indicators
filename ×33ip_v4 ×10domain ×5cve ×4hash_sha1 ×3registry_key ×2
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High