LuminousMoth

Threat Actor updated 4 days ago (2024-11-29T13:56:14.190Z)
Download STIX
Preview STIX
LuminousMoth is a threat actor group with potential affiliations to a Chinese-speaking entity, exhibiting similar targeting and Tactics, Techniques, and Procedures (TTPs) as the HoneyMyte group. These similarities include the use of DLL side-loading, Cobalt Strike loaders, and a component akin to LuminousMoth’s Chrome cookie stealer seen in previous HoneyMyte activity. The malware deployed by LuminousMoth first executes “explorer.exe” to reveal hidden directories containing the victim's original documents, then copies four LuminousMoth samples to a specific location on the victim's computer. This malware propagates by duplicating itself onto removable drives connected to the system, explaining the high rate of infections. Further connections between LuminousMoth and HoneyMyte have been established through overlaps in infrastructure and resources used. For instance, the domain mmtimes.org, previously associated with Mustang Panda operations, was found to be used by LuminousMoth, suggesting a link between the two groups. Additionally, the Remote Access Tool PlugX, data exfiltration via Google Drive, HTML code injection using ARP spoofing, and other binaries vulnerable to sideloading were identified as part of LuminousMoth's operation, underscoring its sophisticated capabilities. The evidence also suggests that LuminousMoth is responsible for a previously unreported payload, which includes more tools used for data collection and persistence mechanisms. A process named "svmetrics.exe" was linked to a malicious file copied by the malware, demonstrating another aspect of LuminousMoth's operation. Infrastructure overlaps between the Command and Control (C2) servers used in the LuminousMoth campaign and older campaigns attributed to HoneyMyte further corroborate the connection between these two groups. Based on these findings, there is medium to high confidence that LuminousMoth's activities are indeed connected to HoneyMyte.
Description last updated: 2024-09-25T13:20:06.683Z
What's your take? (Question 1 of 3)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Mustang Panda is a possible alias for LuminousMoth. Mustang Panda, a China-aligned Advanced Persistent Threat (APT) group, has been identified as a significant cyber threat actor involved in a series of malicious activities. Notably, Mustang Panda was found to be associated with the BRONZE PRESIDENT phishing lure, which delivered PlugX and used modif
4
Camaro Dragon is a possible alias for LuminousMoth. Camaro Dragon, a Chinese state-sponsored threat actor also known as Mustang Panda, Bronze President, RedDelta, Luminous Moth, Earth Preta, and Stately Taurus, has been identified as a significant cybersecurity concern. The group has been active since at least 2012 and is known for its sophisticated
3
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Espionage
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.