LuminousMoth

Origin🇨🇳 China

Techniques (MITRE ATT&CK)28

SourceMITRE ATT&CK

State sponsor: ChinaAttribution confidence: 50%Target categories: Civil society

Targeted regions: United States · Germany

Also known as:BASINBASIN CASTLEBRONZE PRESIDENTEarth PretaHoneyMytePolarisRed LichStately TaurusTA416TANTALUMTEMP.HEXTwill Typhoon

Vexday analysis

Grupo de espionagem cibernética de língua chinesa, o LuminousMoth (identificador MITRE ATT&CK G1014) está ativo pelo menos desde outubro de 2020 e tem como alvo organizações de alto perfil, incluindo entidades governamentais, em Myanmar, Filipinas, Tailândia e outras regiões do Sudeste Asiático. Pesquisadores de segurança identificaram indícios de conexão entre o LuminousMoth e o grupo Mustang Panda, com base em sobreposições de infraestrutura de rede, alvos similares e TTPs compartilhadas. O grupo possui 28 técnicas documentadas no framework MITRE ATT&CK.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity46

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 28

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Malware Malware Tool Digital Certificates Upload Malware Drive-by Target Link Target

Initial access

Spearphishing Link

Execution

Scheduled Task Malicious Link

Persistence

Registry Run Keys / Startup Folder

Credential access

Steal Web Session Cookie ARP Cache Poisoning

Discovery

System Owner/User Discovery File and Directory Discovery

Lateral movement

Replication Through Removable Media

Collection

Data from Local System Archive Collected Data

Command and control

Web Protocols Ingress Tool Transfer

Exfiltration

Data Transfer Size Limits Exfiltration Over C2 Channel Exfiltration to Cloud Storage

defense-impairment

Modify Registry Code Signing

stealth

Match Legitimate Resource Name or Location Hidden Files and Directories DLL

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 1524

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port45.221.118.46:80Cobalt Strikethreatfox

ip:port45.221.118.46:443Cobalt Strikethreatfox

ip:port38.76.183.197:8082Cobalt Strikethreatfox

ip:port8.222.188.173:443Cobalt Strikethreatfox

ip:port8.219.220.240:7777Cobalt Strikethreatfox

ip:port209.99.184.234:50050Cobalt Strikethreatfox

ip:port120.77.42.217:50000Cobalt Strikethreatfox

ip:port49.235.52.47:3000Cobalt Strikethreatfox

ip:port49.235.52.47:8080Cobalt Strikethreatfox

ip:port49.235.52.47:80Cobalt Strikethreatfox

ip:port49.235.52.47:443Cobalt Strikethreatfox

ip:port49.235.52.47:8083Cobalt Strikethreatfox

ip:port147.139.136.105:8080Cobalt Strikethreatfox

ip:port38.207.177.165:8080Cobalt Strikethreatfox

ip:port147.139.136.105:80Cobalt Strikethreatfox

ip:port147.139.136.105:22Cobalt Strikethreatfox

ip:port147.139.136.105:443Cobalt Strikethreatfox

ip:port2.57.241.129:80Cobalt Strikethreatfox

ip:port38.207.177.165:80Cobalt Strikethreatfox

ip:port38.207.177.165:443Cobalt Strikethreatfox

ip:port147.139.245.149:801Cobalt Strikethreatfox

ip:port45.221.118.46:8080Cobalt Strikethreatfox

ip:port119.45.198.250:55555Cobalt Strikethreatfox

ip:port118.24.42.214:443Cobalt Strikethreatfox

ip:port47.251.29.219:50050Cobalt Strikethreatfox

ip:port47.254.68.68:50050Cobalt Strikethreatfox

ip:port172.232.97.189:4444Cobalt Strikethreatfox

ip:port149.88.66.234:21Cobalt Strikethreatfox

ip:port47.108.86.120:22Cobalt Strikethreatfox

ip:port47.108.86.120:111Cobalt Strikethreatfox

+1524 indicators in total. See them all on the IOCs page.

References

LuminousMoth uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →