Honeymyte

HoneyMyte, also known as Mustang Panda, is a notable threat actor in the cybersecurity landscape. This group has been linked to various malicious activities, including the use of DLL side-loading and Cobalt Strike loaders, similar to the tactics, techniques, and procedures (TTPs) employed by another threat actor, LuminousMoth. The two groups share striking similarities, such as the usage of a component akin to LuminousMoth's Chrome cookie stealer, which was previously observed in HoneyMyte activity. Furthermore, a connection was established through an MMTimes look-alike domain, "mmtimes[.]org," used in a 2020 HoneyMyte campaign. Significant overlaps have been discovered between the command-and-control (C2) servers utilized in the LuminousMoth campaigns and those previously attributed to HoneyMyte. These overlaps extend beyond shared resources, with both threat actors demonstrating common TTPs and a focus on similar target profiles. The concurrent occurrence of their campaigns in Myanmar suggests that LuminousMoth may have borrowed various TTPs from HoneyMyte. Based on these findings, there is medium to high confidence that LuminousMoth's activities are indeed connected to HoneyMyte. Despite attempts to profile LuminousMoth as a separate entity, the shared toolset, campaign scale, targeting, and resource use firmly link it to HoneyMyte. Further analysis indicates that LuminousMoth shows a strong affinity toward HoneyMyte, reinforcing the belief in their interconnected operations.