Science & Tech · Cybersecurity · 2 hrs ago
Leaked files reveal Luna Moth’s methods for extorting organizations
Leaked files attributed to Luna Moth, also known as Silent Ransom Group, describe how the group targets organizations and individuals.
Researchers at Check Point analyzed the files, which appeared on an anonymous onion site in early October 2026.
The files say operators research targets and pose as IT support or security staff to persuade people to grant remote access to their computers.
They describe one person speaking with the victim while another operates the remote-access software, with the two coordinating through group messages.
The aim is to enter a victim’s network, steal confidential information and demand money by threatening to expose it.
The material suggests the group relies on planned, coordinated manipulation of trust, rather than only technical attacks.
Researchers say organizations should train staff to verify unexpected IT requests through a separate, known channel and limit which remote-access tools employees can install.
Leaked files attributed to Luna Moth reveal how the group organizes social-engineering operations to steal confidential information and extort organizations.
Check Point researchers said the files describe scripts for callers posing as IT support and guidance on handling suspicious or resistant targets.
The documents suggest one person speaks with the victim while another uses remote-access software, with the two coordinating through a group messaging service.
The files appeared on an anonymous onion site called “The Luna Moth Files” in early October 2026.
Researchers advised organizations to verify unexpected IT requests through a separate known channel and limit which remote-access tools employees can install.
- Who
- Luna Moth, also known as Silent Ransom Group; analysts also track it as Chatty Spider UNC3753.
- What
- Leaked files describe the group’s methods for gaining remote access, stealing confidential information and extorting victims.
- When
- The files were leaked in early October 2026. Check Point published its analysis on October 9.
- Where
- The files appeared on an anonymous onion site called “The Luna Moth Files.
- Why
- The operations are designed to steal confidential information and extort financial payments through blackmail.
This story does not have two clearly opposing sides.
If authentic, the exposure shows that Luna Moth should be understood less as a conventional ransomware crew and more as a specialized data-extortion business whose core platform is the coordinated manipulation of trust
Files claiming to contain Luna Moth internal documents and chat logs were leaked to an anonymous onion site.
Check Point published its analysis of the files.
- Group
- Luna Moth, also known as Silent Ransom Group
- Other tracking name
- Chatty Spider UNC3753
- Leak site
- The Luna Moth Files, an anonymous onion site
- Analysis date
- October 9, 2026
- Recommended safeguard
- Verify unexpected IT requests through a separate, known channel
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Malware incident at contractor may expose 8.7 million karaoke records
Critical SonicWall flaw faces exploitation days after patch
Cyberattack disrupts refrigeration systems at French supermarkets
Albert Heijn systems remain offline after cybersecurity incident
Attacks disrupt Yandex services and its data centers in Russia
Canadian cybersecurity executive arrested on federal extortion charges
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Cyberattacks disrupt French supermarket freezers and Dutch-Belgian retail operations
Exposure management shifts cybersecurity focus from controls to risk
