LuminousMoth APT: Sweeping attacks for the chosen few

guest · Jul 14, 2021

Cyberattacks with links to Chinese-speaking group target PH gov't entities – Kaspersky
LuminousMoth is said to have links with HoneyMyte, a Chinese-speaking group gathering geopolitical and economic intelligence in Asia and Africa
July 14, 2021
https://www.rappler.com/technology/...ks-chinese-speaking-group-government-entities

Russian cybersecurity firm Kaspersky on Wednesday, July 14, said it had discovered "a rare, widescale advanced persistent threat (APT) campaign against users in Southeast Asia, most notably Myanmar and the Philippines."

"APT actors are known for the frequently targeted nature of their attacks. Typically, they will handpick a set of targets that in turn are handled with almost surgical precision, with infection vectors, malicious implants and payloads being tailored to the victims’ identities or environment," Kaspersky explained in a blog post.
"It’s not often we observe a large-scale attack conducted by actors fitting this profile, usually due to such attacks being noisy, and thus putting the underlying operation at risk of being compromised by security products or researchers."
Click to expand...

The phishing emails sent by the campaign contain a Dropbox download link. When clicked, the link downloads a RAR file disguised as a Word document containing the payload. The malware can then spread through USB drives, in which it creates hidden directories, attempting to move all of the victim's files.

LuminousMoth was found to have links with the HoneyMyte group, also known as Mustang Panda, a "well-known, long-standing" Chinese-speaking cyber gang that historically has been interested in "gathering geopolitical and economic intelligence in Asia and Africa," Kaspersky said in a separate press statement.
Click to expand...

Kaspersky: LuminousMoth APT: Sweeping attacks for the chosen few

Most notably though, we observed the capability of the culprit to spread to other hosts through the use of USB drives. In some cases, this was followed by deployment of a signed, but fake version of the popular application Zoom, which was in fact malware enabling the attackers to exfiltrate files from the compromised systems.
Click to expand...

Log in or Sign up

LuminousMoth APT: Sweeping attacks for the chosen few

guest Guest

Log in or Sign up

LuminousMoth APT: Sweeping attacks for the chosen few

guest Guest

Useful Searches