LuminousMoth

· ATT&CK GroupG1014

Techniques

Software

Tactics

Aliases

Description

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)

Tactic Coverage

resource development (7)collection (3)exfiltration (3)stealth (3)execution (3)persistence (3)discovery (2)privilege escalation (2)command and control (2)initial access (2)defense impairment (2)credential access (2)lateral movement (1)

Techniques Used (28)

T1005Data from Local System

collection

T1030Data Transfer Size Limits

exfiltration

T1033System Owner/User Discovery

discovery

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 28 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (2)

S0154Cobalt Strikemalware S0013PlugXmalware

References (3)

https://attack.mitre.org/groups/G1014 https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited https://securelist.com/apt-luminousmoth/103332/