Fishmonger
FishMonger is a China-linked threat actor associated with cyber-espionage activity and tracked as overlapping with or also known as Earth Lusca. The provided content states FishMonger has been active since 2019. It is described as part of the broader China-aligned / China-nexus ecosystem and has been linked in reporting to clusters including Aquatic Panda. Supporting content also notes overlaps with SixLittleMonkeys, Space Pirates, and Webworm in broader China-aligned activity reporting. The actor has been associated with use of Winnti and ShadowPad malware. One cited report states that campaigns tracked by ESET as Fishmonger matched I-Soon’s activities, and that Fishmonger targeted universities in Hong Kong in 2020 using Winnti and ShadowPad. Additional reporting cited in the content places Fishmonger among at least five ShadowPad-using activity clusters identified since 2017. The content further notes overlaps between leaked I-Soon materials and previously reported FishMonger / Earth Lusca activity, including targeting and use of Winnti/ShadowPad. CYFIRMA’s profile in the provided content describes FishMonger / Earth Lusca as focused on espionage and also financially motivated activity targeting cryptocurrency platforms. The content lists exploited vulnerabilities associated with FishMonger as CVE-2024-21412, CVE-2016-5195, CVE-2023-32315, CVE-2024-23897, CVE-2022-21587, and CVE-2021-22555. Known aliases directly mentioned in the content include Earth Lusca and Aquatic Panda.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
Details on Exploited Vulnerabilities ... CVE-2016-5195 Linux kernel 7.0
Details on Exploited Vulnerabilities ... CVE-2021-22555 Linux 7.8
Details on Exploited Vulnerabilities ... CVE-2022-21587 Oracle Web Applications 9.8
Details on Exploited Vulnerabilities ... CVE-2023-32315 Openfire 7.5
Details on Exploited Vulnerabilities ... CVE-2024-21412 Internet Shortcut Files Security 8.1
1 more CVE tied to this actor tracked in Mallory.
Observables
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-nexus activity cluster noted as overlapping with Webworm.
Referenced only as a China-aligned APT group linked to Webworm.
China-linked cyber-espionage activity (with some financially motivated operations) using vulnerability exploitation and spear-phishing to gain access, followed by credential dumping, process injection, DLL side-loading, proxy/TLS C2, and staged exfiltration; targets government/civil society and also cryptocurrency platforms.
Named activity cluster linked in reporting to I-Soon; associated with espionage-style targeting (e.g., universities in Hong Kong) and use of Winnti and ShadowPad malware.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.