LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.^[2]

LuminousMoth has used HTTP for C2.^[1]

LuminousMoth has manually archived stolen files from victim machines before exfiltration.^[2]

LuminousMoth has used malicious DLLs that setup persistence in the Registry KeyHKCU\Software\Microsoft\Windows\Current Version\Run.^[1][2]

LuminousMoth has collected files and data from compromised machines.^[1][2]

LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.^[2]

LuminousMoth has used unique malware for information theft and exfiltration.^[1][2]

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.^[1]

LuminousMoth has exfiltrated data to Google Drive.^[2]

LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.^[1][2]

LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.^[1]

LuminousMoth has used legitimate executables such aswinword.exe andigfxem.exe to side-load their malware.^[1][2]

LuminousMoth has downloaded additional malware and tools onto a compromised host.^[1][2]

LuminousMoth has disguised their exfiltration malware asZoomVideoApp.exe.^[1]

LuminousMoth has used malware that adds Registry keys for persistence.^[1][2]

LuminousMoth has obtained and used malware such asCobalt Strike.^[1][2]

LuminousMoth has obtained an ARP spoofing tool from GitHub.^[2]

LuminousMoth has used a valid digital certificate for some of their malware.^[1]

LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.^[1]

LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.^[1][2]

LuminousMoth has created scheduled tasks to establish persistence for their tools.^[2]

LuminousMoth has hosted malicious payloads on Dropbox.^[1]

LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.^[2]

LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.^[1]

LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.^[1]

LuminousMoth has signed their malware with a valid digital signature.^[1]

LuminousMoth has used a malicious DLL to collect the username from compromised hosts.^[2]

LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.^[1]