Luna MothThreat actor
- SilentRansomGroup
- tg2729
Luna Moth conducts high-tempo callback phishing campaigns targeting legal and financial organizations in the U. S., using social engineering to lure victims into calling fake helpdesk numbers. Attackers impersonate IT staff to install legitimate RMM tools, enabling direct access to victim systems for data exfiltration.From MISP Galaxy
Last reported 2 days ago, by ransomware.live31 reports
ATT&CK techniques
6 of 49 · each with the sentence it comes from- T1219Remote Access Tools
“T1219 Remote Access Tools (AnyDesk, Zoho, Quick Assist)”
- T1684Social Engineering
“Mapped to ATT&CK Enterprise v19.1 (social engineering sits under T1684 in this version; the former T1656 Impersonation is now T1684.001).”
- T1005Data from Local System
“T1005 Data from Local System”
- T1052.001Exfiltration over USB
“T1052.001 Exfiltration over USB”
- T1566.004Spearphishing Voice
“T1566.004 Spearphishing Voice”
- T1567.002Exfiltration to Cloud Storage
“T1567.002 Exfiltration to Cloud Storage”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
31 reports · the newest 20, newest first · the exact sentence from each-
SilentRansomGroup lists M... C...“SilentRansomGroup lists M...”
-
SilentRansomGroup lists M...r“SilentRansomGroup lists M...r”
-
SilentRansomGroup lists Kirkland & Ellis LLP“SilentRansomGroup lists Kirkland & Ellis LLP”
-
SilentRansomGroup lists K.r.a. ...s“SilentRansomGroup lists K.r.a.”
-
SilentRansomGroup lists K.r.. ...s“SilentRansomGroup lists K.r..”
-
SilentRansomGroup lists Porter Hedges LLP“SilentRansomGroup lists Porter Hedges LLP”
-
SilentRansomGroup lists M... M...“SilentRansomGroup lists M...”
-
SilentRansomGroup lists P... H...“SilentRansomGroup lists P...”
-
SilentRansomGroup lists P...S...R...“SilentRansomGroup lists P...S...R...”
-
SilentRansomGroup lists Latham & Watkins“SilentRansomGroup lists Latham & Watkins”
-
Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew“The FBI’s Private Industry Notification of May 23, 2025, describes SRG (also tracked as Luna Moth, Chatty Spider and UNC3753) as targeting U.S.”
-
Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings“Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings”
-
The Luna Moth Files Weren’t Hacked. Here’s How They Leaked.“The Luna Moth Files Weren’t Hacked.”
-
Silent Ransom Group claims “Luna Moth Files” are fake. The data suggest otherwise.“Silent Ransom Group claims “Luna Moth Files” are fake.”
-
SilentRansomGroup lists O'Hagan Meyer“SilentRansomGroup lists O'Hagan Meyer”
-
SilentRansomGroup lists Baker McKenzie“SilentRansomGroup lists Baker McKenzie”
-
SilentRansomGroup lists Andersen Group Inc.“SilentRansomGroup lists Andersen Group Inc.”
-
SilentRansomGroup lists K...“SilentRansomGroup lists K...”
-
SilentRansomGroup lists Andersen Group“SilentRansomGroup lists Andersen Group”
-
SilentRansomGroup lists A...n“SilentRansomGroup lists A...n”
Indicators in its reports
named in the reports above- aim6umein3kee[.]comin 1 report
- slplsskdj2836v2jjsx[.]comin 1 report
- sleepless[.]coin 1 report
- sleeplessthreat[.]comin 1 report
- threatactorsneversleep[.]comin 1 report
- sokolovsky-law[.]comin 1 report
- ominetdata[.]comin 1 report
- develevenor[.]comin 1 report
- funconnect[.]comin 1 report
- 45.32.232[.]133in 1 report
- 199.217.98[.]21in 1 report
- 216.203.20[.]157in 1 report
- 87.251.67[.]222in 1 report
- 87.251.67[.]223in 1 report
- 66.179.31[.]122in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.