MUSTANG_PANDA__2021__Kaspersky-LuminousMothAPT-Sweeping-attackspdf_07-14-2021.pdf

This report profiles the LuminousMoth APT — a sophisticated, Chinese‑language affiliated campaign active since at least October 2020 that uses spear‑phishing Dropbox links, DLL side‑loading and USB‑based propagation to deploy Cobalt Strike beacons and post‑exploitation tools (a signed fake Zoom stealer and a Chrome cookie stealer) against targets primarily in Myanmar and the Philippines; the report provides detailed infection chains, TTPs, IOCs (hashes, domains, IPs), victim statistics (~1,400 Philippines, ~100 Myanmar) and links to the HoneyMyte/Mustang Panda group.