Kaspersky LuminousMoth July 2021

LuminousMoth has collected files and data from compromised machines.

LuminousMoth has disguised their exfiltration malware as `ZoomVideoApp.exe`.

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.

LuminousMoth has used HTTP for C2.

LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.

LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.

LuminousMoth has downloaded additional malware and tools onto a compromised host.

LuminousMoth has used malware that adds Registry keys for persistence.

LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.

LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.

LuminousMoth has used malicious DLLs that setup persistence in the Registry Key `HKCU\Software\Microsoft\Windows\Current Version\Run`.

LuminousMoth has signed their malware with a valid digital signature.

LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.

LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.

LuminousMoth has used legitimate executables such as `winword.exe` and `igfxem.exe` to side-load their malware.

LuminousMoth has used unique malware for information theft and exfiltration.

LuminousMoth has obtained and used malware such as Cobalt Strike.

LuminousMoth has used a valid digital certificate for some of their malware.

LuminousMoth has hosted malicious payloads on Dropbox.

LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.