Threat intelligence / Group

LuminousMoth

[LuminousMoth](https://attack.mitre.org/groups/G1014) is a Chinese-speaking cyber espionage group that has been active since at least October 2020. [LuminousMoth](https://attack.mitre.org/groups/G1014) has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between [LuminousMoth](https://attack.mitre.org/groups/G1014) and [Mustang Panda](https://attack.mitre.org/groups/G0129) based on similar targeting and TTPs, as well as network infrastructure overlaps.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[LuminousMoth](https://attack.mitre.org/groups/G1014) is a Chinese-speaking cyber espionage group that has been active since at least October 2020. [LuminousMoth](https://attack.mitre.org/groups/G1014) has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between [LuminousMoth](https://attack.mitre.org/groups/G1014) and [Mustang Panda](https://attack.mitre.org/groups/G0129) based on similar targeting and TTPs, as well as network infrastructure overlaps.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)

30 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to ARP Cache Poisoning

Technique

uses

to Cobalt Strike

Malware

uses

to Code Signing

Technique

uses

to Data from Local System

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Digital Certificates

Technique

uses

to DLL

Technique

uses

to Drive-by Target

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to File and Directory Discovery

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Malicious Link

Technique

uses

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Malware

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Replication Through Removable Media

Technique

uses

to Scheduled Task

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Upload Malware

Technique

uses

to Web Protocols

Technique

3 external

References

mitre-attack

G1014

Bitdefender LuminousMoth July 2021

https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited

Kaspersky LuminousMoth July 2021

https://securelist.com/apt-luminousmoth/103332/