- Check Point Research reviewed an unverified leaked archive. It suggests Luna Moth runs social engineering as a process, with separate roles for research, calling, technical access and negotiation.
- The leaked files show no new exploit or malware, and Check Point says controls aimed only at malware will not interrupt this process.
- Leaders should have IT requests verified through a separate known channel, limit remote access tools, and prepare senior staff, especially at law firms.
If the leaked archive is authentic, the key tool in this operation is a phone call. Check Point Research says the files show no new exploit and no new malware. Earlier public reports describe access through legitimate remote support software. The group's strength looks organizational, not technical.
What was leaked, and how far to trust it
Around October 5, 2026, an anonymous dark-web site posted files it said came from Silent Ransom Group. The site calls itself "The Luna Moth Files." The group is also tracked as Luna Moth and UNC3753.
The files include chat logs, a script for voice phishing (scams run by phone), screenshots and a résumé said to belong to a fake employee.
Nobody knows who posted the files or how they were obtained. Check Point treats the claims as unproven unless other sources confirm them. The site has visible flaws. It gives two different message totals. Its main money figure does not match its own table.
Names of operators, confirmed payments and any use of deepfakes all need outside proof. Even so, Check Point finds the material consistent enough to sketch how the group may work. Treat that sketch with caution.
The call steers the victim
Check Point describes the group as one that usually skips encryption. Instead, it talks people into granting access. Then it steals data and threatens to publish or sell it.
Unit 42 documented an early version in 2022. A personalized subscription invoice pointed victims to a phone number the attackers controlled. The call ended with the victim opening a remote support session using legitimate administration software. Mandiant later described callers posing as the victim's own IT staff.
The leaked script shows how the work is shared. The caller must watch a separate group chat during the remote session. The caller reports any change in the victim's behavior there.
Check Point infers that a second person is working on the computer at the same time. Meanwhile, the caller keeps the victim calm. The call becomes a way to steer a person while access and data theft proceed in parallel.
The script follows a planned pattern of worry, reassurance and fresh urgency. Remote access is presented as a protective security check. The chats also mention virtual servers meant for 3CX, a business phone system.
Credibility is built before the first call
Early chats discuss long-established domains, business email accounts and simple websites that look like real companies. Other messages mention signing up for paid people-data services. Lists of senior staff follow, then a request to start calling.
Check Point's conclusion is that the caller arrives knowing the target organization. The persona holds up under a quick check. Senior staff appear on the call lists.
A sales floor with a target market
The chats name four kinds of work. Researchers and persona builders prepare the ground. Callers build authority. Technical participants handle remote sessions and data. Negotiators and payment handlers collect the money.
The files do not show a formal chain of command. This is our interpretation, but the setup resembles a sales team: research, closing, delivery and collections.
Labels such as "CHAT," "OFFER," "CONTRACT" and "GOLD" sit beside revenue estimates and negotiation states. Participants also talk about the legal sector and about targeting the top 100 law firms globally.
Check Point also points to recruitment talk and a project called "Fake_Employee." These hint at attempts to gain longer-lasting human access. They fit the FBI's reports of people posing as IT staff who sought physical access after remote attempts failed.
Check Point says the evidence is strongest for discussions and project ideas. It is weaker for any successful placement of a fake employee.
What to ask your team
Check Point concludes that controls aimed only at malware will not interrupt this process. Infosecurity Magazine, covering the report, relays the same warning about technical controls. The practical questions concern process.
Can an employee approve a remote session after an inbound call? Check Point advises verifying any IT request through a separate, known channel first. Which remote access tools can employees install? Check Point advises limiting them.
Senior staff appear on the groups' call lists, so do those people know how this playbook sounds? Law firms and professional services companies sit closest to the stated target market. Who watches for lookalike domains and invented personas? Who tracks exposed staff data?
If the archive is authentic, Check Point sees the group's core platform as the coordinated manipulation of trust. The defense is a simple, rehearsed way for staff to say no.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Check Point Research.
