Introduction
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps. Kaspersky LuminousMoth July 2021 Bitdefender LuminousMoth July 2021
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1539 Steal Web Session Cookie
- T1567.002 Exfiltration to Cloud Storage
- T1566.002 Spearphishing Link
- T1588.001 Malware
- T1030 Data Transfer Size Limits
- T1564.001 Hidden Files and Directories
- T1608.001 Upload Malware
- T1091 Replication Through Removable Media
- T1041 Exfiltration Over C2 Channel
- T1608.004 Drive-by Target
- T1608.005 Link Target
- T1587.001 Malware
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1557.002 ARP Cache Poisoning
- T1588.002 Tool
- T1005 Data from Local System
- T1204.001 Malicious Link
- T1574.001 DLL
- T1547.001 Registry Run Keys / Startup Folder
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1560 Archive Collected Data
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1053.005 Scheduled Task
- T1588.004 Digital Certificates
- T1553.002 Code Signing
ATT&CK technique IDs (denormalized)
- T1005
- T1030
- T1033
- T1036.005
- T1041
- T1053.005
- T1071.001
- T1083
- T1091
- T1105
- T1112
- T1204.001
- T1539
- T1547.001
- T1553.002
- T1557.002
- T1560
- T1564.001
- T1566.002
- T1567.002
- T1574.001
- T1587.001
- T1588.001
- T1588.002
- T1588.004
- T1608.001
- T1608.004
- T1608.005
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [2] Bitdefender LuminousMoth July 2021 Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022. [3] Kaspersky LuminousMoth July 2021 Lechtik, M, and etl. (2021, July 14). LuminousMoth APT: Sweeping attacks for the chosen few. Retrieved October 20, 2022.