← threatfilter.dev / all groups / LuminousMoth

LuminousMoth

G1014 China Espionage MITRE ATT&CK →

Overview

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.

Targets

Civil society

Regions

Germany · United States

TTPs — 28 techniques across 12 tactics

Resource Development

T1587.001 Malware
T1588.001 Malware
T1588.002 Tool
T1588.004 Digital Certificates
T1608.001 Upload Malware
T1608.004 Drive-by Target
T1608.005 Link Target

Tools & malware (2)

PlugX · Cobalt Strike

Reporting (2)

LuminousMoth - PlugX, File Exfiltration and Persistence Revisited — Botezatu, B and etl
LuminousMoth APT: Sweeping attacks for the chosen few — Lechtik, M, and etl

Overview

Targets

Regions

TTPs — 28 techniques across 12 tactics

Resource Development

Initial Access

Execution

Persistence

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Tools & malware (2)

Reporting (2)