Luna Moth Leaks Show Scripted IT Support Calls and Split Roles for Enterprise Compromise
Check Point analysis of leaked Luna Moth files reveals how attackers use scripted calls and split roles to compromise enterprise networks.
Key points
- Leaked documents expose Luna Moth’s division of labor between social engineers and technical attackers.
- Attackers use scripted phone calls posing as IT support to gain remote access to victim machines.
- One attacker manages the call while a second operator executes commands via remote software.
Check Point researchers analyzed leaked internal files from the Luna Moth ransomware group, also known as Silent Ransom Group. The documents reveal a structured operation where social engineering and technical exploitation are coordinated to steal data and extort victims.
What happened
Leaked files posted to an anonymous onion site in early October 2026 claim to contain internal documents and chat logs from Luna Moth. Cybersecurity analysts also track this group as Chatty Spider UNC3753. Check Point published an analysis of these materials on October 9, detailing the group’s operational procedures. The documents outline a multi-stage process for targeting organizations, beginning with the identification of specific individuals and the gathering of business context. This preparation ensures that initial contact appears legitimate to the target.
The attack typically involves phone calls where the operator poses as IT support or an IT security worker. The goal is to persuade the victim to grant remote access to their enterprise machine using remote access software. Once access is granted, the attacker can move laterally within the network and potentially escalate privileges. The leaked scripts provide instructions on how to handle victims who are resistant or distrustful. These scripts account for common reactions and guide the caller on how to maintain composure and reassurance.
A key finding from the analysis is the division of labor during the active attack phase. The documents suggest that the person speaking to the victim is not the same individual controlling the remote software. One attacker focuses entirely on the conversation, aiming to keep the victim calm and compliant. Meanwhile, a second attacker uses the remote access tool to execute commands and navigate the victim’s system. This separation of duties allows the social engineer to maintain the ruse without technical distractions.
Why it matters
The leaks demonstrate that Luna Moth operates with a businesslike, multi-layered approach rather than through random opportunistic attacks. The use of detailed scripts and role specialization indicates a high level of organization and training among the group’s staff. For security teams, this highlights the sophistication of the social engineering component in ransomware campaigns. The reliance on human error and trust rather than just technical vulnerabilities changes the defensive posture required.
The ability to manipulate victims into voluntarily providing remote access bypasses many traditional perimeter defenses. Once inside, the attackers can exploit the trust placed in the remote access software to expand their foothold. The coordination between the caller and the keyboard operator makes detection more difficult, as the technical activity may appear to originate from a legitimate support session. Understanding this workflow helps IT teams recognize the signs of a coordinated social engineering assault.
What to watch
- Monitor for unexpected remote access sessions initiated by employees, especially during business hours.
- Review call logs for reports of individuals posing as IT support requesting remote access.
- Check for privilege escalation attempts following any remote access event.
- Verify the identity of anyone requesting remote access through out-of-band communication methods.
Background: Social engineering
Social engineering manipulates psychological triggers like urgency and authority to compel victims into bypassing security protocols. It succeeds not because of technical flaws, but because humans are wired to trust familiar patterns and helpful colleagues. Defending against it requires verifying identity through out-of-band channels and treating unexpected requests as suspicious regardless of their source.
Read the full guide: Social Engineering: How Manipulation Bypasses Technical Defenses
What to do and how to stay safe: Luna Moth
- Train employees to verify the identity of anyone claiming to be IT support before granting remote access.
- Implement strict policies requiring multi-factor authentication for all remote access connections.
- Monitor network traffic for unusual remote access activity or connections to unknown endpoints.
- Ensure remote access software is configured to require explicit user consent for each session.
Step-by-step guide: How Identity Theft Works: The Technical Chain of Compromise
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is Luna Moth?
Luna Moth is a ransomware group also known as Silent Ransom Group and tracked as Chatty Spider UNC3753.
How do Luna Moth attackers gain initial access?
They use phone calls posing as IT support to trick victims into granting remote access to their computers.
Are the attackers working alone during the call?
No, the leaks suggest one attacker handles the call while a second operator uses the remote software.
