China's 'Earth Lusca' Propagates Multiplatform Backdoor

Trend Micro researchers reported a novel Golang-based backdoor named KTLVdoor used in an attack attributed to China-linked APT Earth Lusca; the malware (Windows and Linux) masquerades as system utilities, employs strong obfuscation and encrypted communications, and provides full remote-control capabilities. Analysts observed over 50 Alibaba-hosted C2 servers communicating with KTLVdoor variants, suggesting wider testing or shared infrastructure among Chinese-speaking threat actors; the report includes IOCs and defensive recommendations.