MITRE ATT&CKgroup

G1014 LuminousMoth

Published 2023-02-23 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2023-02-23

Description

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.

Related

Uses · MITRE ATT&CK (30)

  • T1608.001 Upload Malware sub-technique
  • T1608.004 Drive-by Target sub-technique
  • T1608.005 Link Target sub-technique
  • T1557.002 ARP Cache Poisoning sub-technique
  • T1587.001 Malware sub-technique
  • T1588.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1588.004 Digital Certificates sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1574.001 DLL sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1560 Archive Collected Data technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1553.002 Code Signing sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1539 Steal Web Session Cookie technique
  • S0154 Cobalt Strike software (malware)
  • S0013 PlugX software (malware)
  • T1005 Data from Local System technique
  • T1030 Data Transfer Size Limits technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1083 File and Directory Discovery technique
  • T1091 Replication Through Removable Media technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique

References