Skip to content
skopnix
← Adversaries

File · LuminousMoth · Unknown · refreshed 2026-10-18

LuminousMoth

MITRE G1014 ↗

LuminousMoth — ATT&CK roseLU

attack rose · 28 techniques across 12 tactics

Analyst brief

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.

Observed targets (as stated by the sources)

4 countries · 0 sectors
ChinaMyanmarPhilippinesThailand

assessed originnot stated by sourcesobserved targets · 4

countries · 4

  • China
  • Myanmar
  • Philippines
  • Thailand

as stated by the cited sources, not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

28 techniques · 12 of 15 tactics

  1. Resource development

    7 techniques

  2. Initial access

    1 technique

  3. Execution

    2 techniques

  4. Persistence

    1 technique

  5. Stealth

    3 techniques

  6. Defense impairment

    2 techniques

  7. Credential access

    2 techniques

  8. Discovery

    2 techniques

  9. Lateral movement

    1 technique

  10. Collection

    2 techniques

  11. Command and control

    2 techniques

  12. Exfiltration

    3 techniques

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
PlugXS0013 ↗
Cobalt StrikeS0154 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

6 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 85 more

    T1105conf 80SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    rclone copy or sync to remote storage (T1567.002)

    APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · 19 more

    T1567.002conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Primary-source reports

linked, never re-hosted
  1. 2021LuminousMoth APT: Sweeping attacks for the chosen fewKaspersky ↗

Take it with you

keyless · no signup

References

3 sources
  1. 1.attack.mitre.org/groups/G1014
  2. 2.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-per…
  3. 3.securelist.com/apt-luminousmoth/103332

Track LuminousMoth on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.