Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings
Luna Moth Leaks Expose Ransomware Tactics 🚨
Analysis by cybersecurity researchers at Check Point, published on October 9, has exposed what appears to be the inner workings of the Silent Ransom Group. Leaked files disclosed to an anonymous onion site called “The Luna Moth Files” in early October 2026 claim to contain internal files and chat logs of Luna Moth, commonly also known as Silent Ransom Group (SIG). This group is also tracked by cybersecurity analysts as Chatty Spider UNC3753.
The analysis revealed that Luna Moth demonstrates a multi-layered, businesslike approach to its operations, with ‘staff’ working on several stages designed to steal confidential information and extort financial payments from victims using blackmail. Check Point researchers revealed information on the instructions the Luna Moth group provides to ‘staff’ on how to best emotionally manipulate their victims into providing remote access to their enterprise machines and how the work is divided up between a social engineer and the hands-on keyboard attacker.
Planning and Execution 🎯
The operation begins at a planning stage, in which criminal operators identify organizations and individuals to target, with the required business context to ensure that the initial contact appears entirely legitimate before the victim is persuaded to communicate over the phone. In many cases, the attacker poses as IT support or an IT security worker, using the persona to convince the target to provide remote access to their computer via a remote access software tool. This provides the attacker with initial access to the network, which can be abused to move around and even escalate their privileges.
According to the leaked documents, the attackers are provided with scripts to follow which take into account common responses and reactions from their victim, including advice on how the caller should handle a victim who isn’t trusting or otherwise resistant to the attacker.
Coordinated Manipulation 🤝
One element of the social engineering attacks which the leaks appear to have revealed is that when the attackers are on the phone to the victim posing as the IT support worker, the caller isn’t acting alone. The documents appear to suggest that while one individual is actively speaking to the victim to reassure them and keep them calm, it’s another individual who is actually using the remote software. According to the leaked files, the two cyber-criminals coordinate their efforts using a group messaging service.
“If authentic, the exposure shows that Luna Moth should be understood less as a conventional ransomware crew and more as a specialized data-extortion business whose core platform is the coordinated manipulation of trust,” said the Check Point report.
Protecting Against Cyber Extortion 🔒
Given how the activity directly targets people, researchers warned that technical controls are not enough to keep organizations safe from the threat posed by cyber extortion activity which operates in this way. Steps organizations can take to help protect staff from falling victim to campaigns like this include encouraging employees to verify any unexpected IT requests through a separate, known channel before approving a remote session and to limit which remote access tools employees can install.