Cataloged
IdentityTracking identifier: G1014
Reviewed identity mapping approved on this date.
LuminousMoth
Tracked as
G1014
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
LuminousMothCanonical Name
G1014Tracking Id
Shared-name reviews
Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.
Identity remains unresolved
medium
MITRE maintains LuminousMoth and Mustang Panda as separate group records while describing targeting, technique, and infrastructure overlap. The shared LUMINOUS MOTH name is not sufficient evidence of exact equivalence.
Loading CVEs, techniques, indicators, malware, victims, and activity...