Luna Moth leak exposes specialized data-extortion operating model
Threat Actor Meta
Summary
Hide ▲
Show ▼
Leaked internal files and chat logs show Luna Moth / Silent Ransom Group (SIG) running a specialized data-extortion operation with split roles, scripted social engineering, and coordinated remote access, raising the scale and reliability of its extortion workflow. The files, surfaced in early October 2026 and analyzed on October 9, 2026, indicate that one operator handles the victim-facing trust manipulation while another controls the session behind the scenes. That structure turns the group into a repeatable criminal service model rather than a loose ransomware crew.
Related Happenings
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor Meta
H score26
First: 10.06.2026 17:03
Last: 10.06.2026 17:03
Sources 1
About this happening:
The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor MetaAbout this happening: The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
Silent Ransom Group shifts from Conti-linked ransomware participation to standalone data-theft extortion
Threat Actor Meta
H score21
First: 07.06.2026 17:09
Last: 07.06.2026 17:09
Sources 1
About this happening:
Silent Ransom Group (UNC3753) is a standalone data-theft extortion actor that has operated separately since 2022 after the Conti shutdown, using stolen data and le...
Silent Ransom Group shifts from Conti-linked ransomware participation to standalone data-theft extortion
Threat Actor MetaAbout this happening: Silent Ransom Group (UNC3753) is a standalone data-theft extortion actor that has operated separately since 2022 after the Conti shutdown, using stolen data and le...
Silent Ransom Group US law firm IT impersonation campaign
Campaign
H score36
First: 29.05.2026 16:00
Last: 29.05.2026 16:00
Sources 1
How related:
The documents were leaked to an anonymous onion site called “The Luna Moth Files” in early October 2026 and claim to contain internal files and chat logs of Luna Moth, commonly also known as Silent Ransom Group (SIG).
About this happening:
Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider UNC3753, is a data-extortion campaign that has targeted U.S.-based law firms since 2023...
Silent Ransom Group US law firm IT impersonation campaign
CampaignHow related: The documents were leaked to an anonymous onion site called “The Luna Moth Files” in early October 2026 and claim to contain internal files and chat logs of Luna Moth, commonly also known as Silent Ransom Group (SIG).
About this happening: Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider UNC3753, is a data-extortion campaign that has targeted U.S.-based law firms since 2023...
Timeline
-
09.10.2026 18:15 2 articles · 3d ago
Check Point exposes Luna Moth's trust-manipulation extortion workflow
Initial DisclosureCheck Point researchers analyzed leaked files and chat logs tied to Luna Moth, also tracked as Silent Ransom Group (SIG) and Chatty Spider UNC3753, and found a multi-layered operation that uses social engineering, remote access software, and coordinated role separation to steal confidential information and extort victims. The leaked instructions show staff being coached on how to emotionally manipulate targets into granting remote access to enterprise machines, with one operator handling the victim-facing phone pretext while another controls the remote session and the two coordinating through a group messaging service.
Show sources
- Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings — www.infosecurity-magazine.com — 12.10.2026 18:15
- Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings — www.infosecurity-magazine.com — 12.10.2026 18:15