wonderfully unique software solutions

Kaspersky: Luminous Moth under microscope as USB and Zoom threat

Kaspersky, vendor of Kaspersky Total Security, has profiled the so-called Luminous Moth advanced persistent threat to USB drives and Zoom users in its regular threat intelligence report.

According to Kaspersky‘s Mark Lechtik, Paul Rascagneres and Aseel Kayal, the Luminous Moth attacks represents a precise yet sweeping high-volume attack on a chosen few.

“Most notably though, we observed the capability of the culprit to spread to other hosts through the use of USB drives,” they write.

“In some cases, this was followed by deployment of a signed, but fake version of the popular application Zoom, which was in fact malware enabling the attackers to exfiltrate files from the compromised systems.”

According to Kaspersky, the “sheer volume” of the attacks may be caused by a rapid replication through removable devices or by an unknown infection vector such as a watering hole or another kind of supply chain attack.

Watering hole attacks operate by identifying a website frequented by users within an organisation or even an entire sector, such as defence, government or healthcare, that the malicious actor wishes to target.

Kaspersky’s Mark Lechtik, Paul Rascagneres and Aseel Kayal write that a set of targets can be handpicked with almost surgical precision. Infection vectors, malicious implants and payloads can be tailored to victim identities or environments.

“It’s not often we observe a large-scale attack conducted by actors fitting this profile, usually due to such attacks being noisy, and thus putting the underlying operation at risk of being compromised by security products or researchers,” they explain.

Kaspersky has observed Luminous Moth attacks originating in South-East Asia as far back as October 2020, with most early sightings in Myanmar but tending more now to come from the Philippines, where there are “now more than ten times as many known targets”.

An attack could begin with a spear-phishing email including access to a Dropbox download. This link, in observed instances, leads to a malicious .RAR archive disguised as a Microsoft Word document. It can then attempt to spread via removable USB drives via, for example, Microsoft Silverlight executable sllauncher.exe, or wwlib.dll.

Luminous Moth has an affinity with the HoneyMyte/Mustang Panda group of threats.

“In fact, our colleagues at ESET and Avast recently assessed that HoneyMyte was active in the same region. The proximity in time and common occurrence in Myanmar of both campaigns could suggest that various tactics, techniques and procedures (TTPs) of HoneyMyte may have been borrowed for the activity of Luminous Moth.”

The blog post goes on to profile many more specifics of Luminous Moth, including its infection chain and toolset.

( Photo by James Wainscoat on Unsplash )

Recent Articles

N-able rebrands RMM as N-sight – targeting IT teams and emerging MSPs

N-able has relaunched its RMM remote monitoring and management as N-able N-sight RMM, with a view to attracting more IT departments and...

Stormshield and partners warn of cybersecurity risks to Paris 2024

Giant global events -- such as the Paris 2024 Olympic Games -- can expect to continue to be targeted by cyber criminals...

Usecure builds security awareness focus, adds platform functionalities

MSP-focused security vendor Usecure is continuing to expand the capabilities of its human risk management focused software for partners.

Phishing attacks still plague common file types, Hornetsecurity warns

Phishing via archive, HTML, Excel or PDF files remain the leading email-based cyber attack on organisations, according to cybersecurity specialists at Hornetsecurity.

How TechSmith video-based learning can boost diversity and inclusion

When Hillsborough Community College in the USA wanted to create a remote-learning platform to assist students who use sign language, it turned...

Related Stories

Leave A Reply

Please enter your comment!
Please enter your name here

Weirdware monthly - Get the latest news in your inbox