“If authentic, the exposure shows that Luna Moth should be understood less as a conventional ransomware crew and more as a specialized data-extortion business whose core platform is the coordinated manipulation of trust,” said the Check Point report.
The Luna Moth leaks and Check Point's findings
Leaked files published to an anonymous onion site called “The Luna Moth Files” in early October 2026 claim to contain internal documents and chat logs from Luna Moth, also known as Silent Ransom Group (SIG) and tracked by some analysts as Chatty Spider UNC3753. Cybersecurity researchers at Check Point analysed the material and, in a report published on October 9, described what appears to be a multi-layered, businesslike approach to cyber extortion that centers on stealing confidential data and then using it for blackmail.
A scripted social-engineering playbook
According to the leaked files and Check Point’s analysis, the group’s operation begins at a planning stage in which operators identify organisations and individuals to target and gather the “required business context” so initial outreach appears legitimate. Attackers then typically pose as IT support or IT security staff and use that persona to persuade a victim to provide remote access to their enterprise machine via a remote access software tool. The resulting access can be abused to move laterally inside a network and escalate privileges.
The documents reportedly include scripts for callers that take into account “common responses and reactions” from victims and offer specific advice on how to handle a person who is untrusting or resistant. The guidance is designed to emotionally manipulate targets into approving remote sessions and surrendering control of their endpoints.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDivision of labor: caller, keyboard operator, and coordination
The leaked material appears to show that the social engineering phase is typically operated by a team, not a lone scammer. While one individual is on the phone reassuring and calming the victim, another is said to be using the remote-access software to perform hands-on actions. The two operators coordinate their work via a group messaging service, according to the files reviewed by Check Point.
That division of labor — scripted caller plus a separate operator performing the machine-level activity — mirrors a sales-oriented model rather than the lone hacker stereotype. The documents depict a repeatable workflow that separates the psychological task of persuasion from the technical task of network intrusion and data theft.
Why technical controls alone won't stop this campaign
Check Point’s analysts warn that because the activity directly targets people, technical controls by themselves are insufficient to eliminate the threat. The leaked playbook demonstrates how social engineering creates legitimate-looking openings that bypass or defeat some automated protections by convincing authorised users to grant access.
The researchers point to practical, behavioural mitigations organisations can adopt: encourage staff to verify any unexpected IT requests through a separate, known channel before approving a remote session, and limit which remote-access tools employees are allowed to install. Those steps are presented in the leaked documents as sensible countermeasures against the group’s preferred routes into networks.
What this means for technologists, enterprises, and employees
- Technologists and security teams: anticipate incidents that begin with socially engineered remote sessions and focus detection on anomalous remote-control activity, lateral movement, and privilege escalation once a session is active.
- Enterprises and procurement leaders: enforce policies that restrict which remote-access tools can be installed and implement verification workflows so employees confirm unexpected IT contact via known, separate channels.
- Employees and end users: treat unsolicited IT calls with caution, follow verification procedures before granting access, and be aware that callers may be using scripted responses designed to overcome resistance.
The leaked Luna Moth materials, as described by Check Point, paint a picture of an organised, repeatable extortion business built on manipulating trust rather than a purely technical exploit chain. If the documents are authentic, the challenge for defenders is less about a single vulnerability and more about breaking a coordinated human workflow — by hardening verification practices, limiting toolsets, and detecting the follow-on movements that happen after a remote session is granted.
