LuminousMoth
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.
- ATT&CK ID
- G1014
- Origin
- China
- Techniques
- 24
- Tools
- 2
Techniques
Resource Development
Develop CapabilitiesObtain CapabilitiesStage Capabilities
Initial Access
Replication Through Removable MediaPhishing
Execution
Scheduled Task/JobUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobModify RegistryBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart Execution
Stealth
MasqueradingHide ArtifactsHijack Execution Flow
Defense Impairment
Modify RegistrySubvert Trust Controls
Credential Access
Steal Web Session CookieAdversary-in-the-Middle
Discovery
System Owner/User DiscoveryFile and Directory Discovery
Lateral Movement
Replication Through Removable Media
Collection
Data from Local SystemAdversary-in-the-MiddleArchive Collected Data
Command and Control
Application Layer ProtocolIngress Tool Transfer
Exfiltration
Data Transfer Size LimitsExfiltration Over C2 ChannelExfiltration Over Web Service
Software
Cobalt Strike · PlugX