Bitdefender LuminousMoth July 2021

LuminousMoth has collected files and data from compromised machines.

LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.

LuminousMoth has used a malicious DLL to collect the username from compromised hosts.

LuminousMoth has created scheduled tasks to establish persistence for their tools.

LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.

LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.

LuminousMoth has downloaded additional malware and tools onto a compromised host.

LuminousMoth has used malware that adds Registry keys for persistence.

LuminousMoth has used malicious DLLs that setup persistence in the Registry Key `HKCU\Software\Microsoft\Windows\Current Version\Run`.

LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.

LuminousMoth has manually archived stolen files from victim machines before exfiltration.

LuminousMoth has exfiltrated data to Google Drive.

LuminousMoth has used legitimate executables such as `winword.exe` and `igfxem.exe` to side-load their malware.

LuminousMoth has used unique malware for information theft and exfiltration.

LuminousMoth has obtained and used malware such as Cobalt Strike.

LuminousMoth has obtained an ARP spoofing tool from GitHub.

LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.