Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
28
techniques
2
software
11,588
corpus matches
profile
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.
techniques
28 attributed · most-instrumented first
software
2 malware & tools attributed
PlugX
S0013
Cobalt Strike
S0154
read this carefully
11,588 corpus matches is not attribution
That count is indicators which exhibit techniques LuminousMoth is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
persistence · privilege-escalation
+16 more techniques
showing 30 of 11,588