Skip to content

LuminousMoth

IntrusionSet · ATTACK:enterprise:G1014

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1014",
  "title": "LuminousMoth",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1014",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--b7f627e2-0817-4cd5-8d50-e75f8aa85cc6",
  "external_id": "G1014",
  "domain": "enterprise",
  "created": "2023-02-23T15:31:38.829Z",
  "modified": "2026-07-31T18:48:13.778Z",
  "version": "1.0",
  "aliases": [
    "LuminousMoth"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Bitdefender LuminousMoth July 2021",
      "url": "https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"
    },
    {
      "source_name": "Kaspersky LuminousMoth July 2021",
      "url": "https://securelist.com/apt-luminousmoth/103332/"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--002f1039-f4c5-4c60-b8ac-ced374bec2ac

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03aece39-d7a2-47a4-be1a-b1d6f1d72654

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03c424ec-df52-4b08-8b32-fa8b2a738a97

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05581e74-e78f-40e1-aa13-c990a99cbac3

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07a569f4-ecb0-45b2-a880-3542508e9835

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17bb48d5-7b1b-43be-b18e-07bc0462cad5

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18ba352d-274c-4cb5-8916-d95035a2423c

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--242a60b4-114e-4dc5-9577-72dfd375a93c

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28d81681-8dcf-45ee-a5e6-378327ce93ce

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1608.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28f7e7c9-76ef-48c7-b027-f32256ad2907

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1608.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33119ed3-3f9c-43b1-a371-53a1cfdce144

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e26385f-0aa0-44a3-8830-978610a1680d

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4688dc57-9101-4f37-a2e3-9b89da7634ed

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a393124-ffca-447e-b230-468f2c57e023

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1557.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cd6e7fd-b6c6-4796-91d5-6cf4ab724adf

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ff56332-1e9e-4853-baae-5918e41882ac

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65f63217-5473-4093-afcc-070c5e757a29

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:S0013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71485f5d-f685-403d-a0da-72acbae0f79e

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74480cd6-1f2e-4c2d-a1ad-82cc50d63d14

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f8b1475-9e41-41d7-84f5-6c4041c4071a

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--856db86a-62a6-4545-898f-7eb44924cfde

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95e83e36-ba44-4e8f-8afe-ff6622fd6f84

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--986f3f81-7872-4c99-a704-4e53f2936e26

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e8e158e-31a9-406e-8b58-68ef645b0cc8

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a980cbf6-262e-41c8-aec3-890ed77966ce

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b29088a3-47cf-4799-a8e5-428472908d06

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b47be693-c3f4-4f21-ba08-4e2fe170bc51

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1588.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea4a70c8-5952-4a61-86a2-bdc801a64dc8

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb4ce173-6f0e-4c12-9ff8-09c4fb1ae2d3

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2ab4a93-9b9f-4c14-a879-200c512d406f

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.