{"id":2926,"date":"2021-07-19T14:56:37","date_gmt":"2021-07-19T12:56:37","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2926"},"modified":"2026-06-08T22:42:36","modified_gmt":"2026-06-08T22:42:36","slug":"luminousmoth-china-apt","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/luminousmoth-china-apt\/","title":{"rendered":"China APT: LuminousMoth"},"content":{"rendered":"\n

Recently, malware campaigns executed by a threat actor<\/strong><\/em> associated with the Chinese government have been identified. This actor conducts large-scale attacks followed by targeted activities involving deployment of malware and data exfiltration operations.<\/p>\n

The campaign, which dates back at least to October of the previous year, targets Myanmar and the Philippines.<\/span><\/p>\n\n\n\n

Analysts who identified the activities<\/a> have designated the threat actor<\/em> as “LuminousMoth<\/strong>“.<\/p>\n

LuminousMoth employs a unique set of tools and propagation methods, including malware replication across all connected USB devices, though their offensive infrastructure shares components with another notorious Chinese hacker group known as Mustang Panda<\/strong>, also tracked as HoneyMyte<\/strong>, TA416<\/strong>, or RedDelta<\/strong>.<\/p>\n\n\n\n

Mustang Panda TTPs<\/h2>\n\n\n\n

Typical behavior and compromise chain attributed to Mustang Panda: <\/p>\n\n\n\n

    \n
  1. Connection to a Google Drive<\/strong> folder, obfuscated using the “link shortener” service goo.gl<\/em>.
    When accessed, the Google Drive link retrieves a zip file containing a .lnk<\/em> file masqueraded as a .pdf file (double extension).
    This file<\/em> redirects the user to a Windows Scripting Component<\/strong> (.wsc<\/em>) hosted on a microblogging page controlled by the adversary.
    MUSTANG PANDA has previously used the microblogging site to host malicious PowerShell<\/strong> scripts and Microsoft Office<\/strong> documents in targeted attacks against NGOs<\/strong> focused on Mongolia.<\/li>\n
  2. The .lnk<\/em> file uses a VBScript<\/strong> component to retrieve a PDF (decoy) file and a PowerShell<\/strong> script from the attacker-controlled web page.<\/li>\n
  3. The PowerShell<\/strong> script creates a Cobalt Strike<\/strong> stager payload and an XOR-encoded beacon.<\/li>\n<\/ol>\n\n\n\n

    Additional Similarities<\/h4>\n\n\n\n

    Among the criminal groups, notable similarities are evident in tactics, techniques, and procedures (TTPs) employed beyond the use of Cobalt Strike beacons. Last month, Avast attributed to Mustang Panda a supply chain<\/strong><\/em> attack against the website of the office of the president of Myanmar<\/strong>, demonstrating specific interest in the same regions targeted by LuminousMoth<\/strong>. The two APTs also share use of DLL sideloading<\/strong><\/em>, as well as employment of dumping<\/em> techniques for Chrome authentication cookies. Through Cyber Threat Intelligence<\/a> analysis, we have tracked consistent patterns in their operational infrastructure.<\/p>\n\n\n\n

    The targets, in both cases, are a selection of high-profile government entities<\/strong> within the two targeted countries: the Ministry of Transport and Communications of Myanmar<\/strong> and the Development Assistance Coordination Unit<\/strong> of the country’s department for foreign economic relations. <\/p>\n\n\n

    Attack Structure<\/h2>\n\n\n

    Compromises begin with spear-phishing<\/strong> emails sent to targets. The email contains a link to download a rar<\/strong> archive via Dropbox<\/strong> related to Covid-19. Inside are a pair of malicious DLLs<\/strong>, masqueraded as .DOCX<\/em> files. Following initial infection, the DLLs are loaded by two executables to propagate across removable devices and launch Cobalt Strike beacons.<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    In some cases in Myanmar attacks, the initial infection was followed by deployment of a signed and fraudulent version of the popular Zoom<\/strong> application. The installation was actually malware that enabled attackers to exfiltrate files from compromised systems. The valid certificate is owned by Founder Technology<\/strong>, a subsidiary of the Founder Group<\/strong> of Peking University<\/strong>, based in Shanghai.<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Assessment<\/h2>\n\n\n\n

    As observed, there are differences between the attack chains of LuminousMoth<\/strong> and MustangPanda<\/strong>. However, it is highly probable that this new operator<\/em><\/strong> is nonetheless the same Mustang Panda<\/strong> implementing new techniques in an effort to obscure its operational footprint by reorganizing and deploying new malware variants. Attribution confidence remains high when infrastructure and targeting patterns are considered holistically across campaigns.<\/p>\n","protected":false},"excerpt":{"rendered":"

    LuminousMoth: China-aligned APT operations against Southeast Asian government and telecom targets, USB-based propagation, custom backdoors and infrastructure overlaps.<\/p>\n","protected":false},"author":1,"featured_media":2615,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[3186,3065,3187,207,238,239,350,3188],"class_list":["post-2926","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-china-apt","tag-espionage","tag-government-targeting","tag-luminousmoth","tag-mustang","tag-mustangpanda","tag-threat","tag-usb-spread"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=2926"}],"version-history":[{"count":2,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2926\/revisions"}],"predecessor-version":[{"id":9863,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2926\/revisions\/9863"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=2926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=2926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=2926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}