FORENSIA

THREAT_ACTOR · G1014

LuminousMoth

Also known as: LuminousMoth

Profile

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.

MITRE ATT&CK ↗

Techniques

28 ATT&CK techniques attributed to this actor.

Software

2 malware/tools attributed to this actor.

PlugXCobalt Strike

Related corpus activity

10,267 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to LuminousMoth.

IndicatorTypeFamilySevSrc
cve-2026-3102cve853
cve-2026-1969cve851
cve-2013-3307cve852
cve-2014-2321cve851
cve-2025-2492cve852
cve-2021-29441cve851
cve-2025-66478cve852
cve-2021-27076cve851
cve-2016-15047cve854
cve-2018-8007cve851
cve-2021-4045cve851
cve-2020-22658cve852
cve-2017-18377cve851
cve-2021-25646cve851
cve-2022-47945cve851
cve-2016-5681cve852
cve-2025-0921cve852
cve-2026-22584cve852
cve-2025-11837cve852
cve-2025-68670cve852
cve-2025-34054cve854
cve-2024-1781cve851
cve-2025-23304cve852
cve-2023-44976cveransomware852
cve-2020-17456cve851
cve-2020-22653cve852
cve-2025-34117cve851
cve-2026-4368cveransomware851
cve-2013-7471cve851
cve-2026-0740cve851

Showing the top 30 by severity of 10,267.