Key points
- Luna Moth uses coordinated teams where one person handles social engineering while another executes technical access.
- Attackers follow detailed scripts to manage victim resistance and maintain the illusion of legitimate IT support.
- The operation aims to gain remote access to enterprise machines for data theft and financial extortion.
Leaked internal documents from the Luna Moth ransomware group, published in early October 2026, expose a highly structured approach to compromising enterprise networks. According to an analysis by Check Point researchers released on 9 October, the group employs a multi-layered strategy that separates social engineering tasks from technical exploitation to maximise success rates.
The files, hosted on an anonymous onion site titled “The Luna Moth Files”, contain chat logs and operational instructions. These materials illustrate how the group, also known as Silent Ransom Group (SIG) and tracked as Chatty Spider UNC3753, organises its workforce. The documents reveal a businesslike division of labour designed to steal confidential information and extort payments through blackmail.
Operational tactics and coordination
The attack lifecycle begins with a planning phase where operators identify specific organisations and individuals. They gather sufficient business context to ensure their initial contact appears entirely legitimate before attempting to move the conversation to a phone call. This preparation is critical for establishing trust and lowering the target’s guard during the subsequent social engineering phase.
During the call, the attacker typically poses as an IT support worker or a security professional. The goal is to persuade the victim to grant remote access to their computer using remote access software. Once this access is granted, the attacker gains an initial foothold in the network, which can then be abused to move laterally and escalate privileges within the enterprise environment.
The human element of the breach
A key finding from the Check Point analysis is the use of detailed scripts provided to the social engineers. These scripts anticipate common victim responses and reactions, including advice on how to handle individuals who are distrustful or resistant to providing access. This suggests a high level of training and standardisation within the group’s operational procedures.
The leaks also reveal that the caller on the phone is not acting alone. While one individual speaks to the victim to reassure them and keep them calm, a second operator is simultaneously using the remote software. This two-person team approach allows the social engineer to focus entirely on manipulation while the technical operator executes the access without interrupting the conversation.
Our take on the response
The revelation of such coordinated tactics suggests that traditional single-point defences may be insufficient. Organisations must recognise that attackers are using human psychology as a primary vector, supported by real-time technical execution. Security operations teams should treat remote access requests with heightened scrutiny, regardless of how legitimate the caller appears.
The fact that attackers have scripts for handling resistance indicates they are prepared for pushback. This means that standard security awareness training may not be enough if it does not cover advanced social engineering scenarios. Teams need to verify the identity of callers through independent channels before granting any form of remote access to corporate systems.
What to do and how to stay safe: Luna Moth
- Verify all remote access requests through a secondary, out-of-band communication method before granting permissions.
- Train staff to recognise signs of coordinated social engineering, such as pressure tactics or unusual urgency.
- Monitor remote access software logs for unusual patterns or access from unauthorised locations.
- Ensure that IT support protocols include strict identity verification steps for any support request.
Step-by-step guide: Stop Credential Leaks: 3 Immediate Actions to Secure Accounts
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the Luna Moth ransomware group also known as?
The group is also known as Silent Ransom Group (SIG) and is tracked by analysts as Chatty Spider UNC3753.
How do Luna Moth attackers gain initial access to networks?
Attackers pose as IT support or security workers to persuade victims to grant remote access via remote access software.
What role do scripts play in these attacks?
Scripts provide attackers with instructions on how to handle victim responses, including advice for managing distrust or resistance.