Home / Threat actors / LuminousMoth

LuminousMoth G1014

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

35

Techniques

2

Malware and tools

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1587.001 Malware T1588.001 Malware T1588.002 Tool T1588.004 Digital Certificates T1608.001 Upload Malware T1608.004 Drive-by Target T1608.005 Link Target

Initial Access

T1091 Replication Through Removable Media T1566.002 Spearphishing Link

Execution

T1053.005 Scheduled Task T1204.001 Malicious Link T1574.001 DLL

Persistence

T1053.005 Scheduled Task T1112 Modify Registry T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder

Stealth

T1036.005 Match Legitimate Resource Name or Location T1564.001 Hidden Files and Directories T1574.001 DLL

Defense Impairment

T1112 Modify Registry T1553.002 Code Signing

Credential Access

T1539 Steal Web Session Cookie T1557.002 ARP Cache Poisoning

Discovery

T1033 System Owner/User Discovery T1083 File and Directory Discovery

Lateral Movement

T1091 Replication Through Removable Media

Collection

T1005 Data from Local System T1557.002 ARP Cache Poisoning T1560 Archive Collected Data

Command and Control

T1071.001 Web Protocols T1105 Ingress Tool Transfer

Exfiltration

T1030 Data Transfer Size Limits T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage

Malware and tools

Cobalt StrikeMalwareS0154
PlugXMalwareS0013

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.