Luna Moth (Silent Ransom Group)
Malware-free extortion crew that phones staff posing as IT, gets a remote session and steals files by hand; focused on US law firms since 2023.
- Active
- March 2022 to September 2026
- Type
- Cybercrime
- Affiliates
- Silent Ransom Group (FBI), Chatty Spider (CrowdStrike), UNC3753 (Mandiant), TG2729 (Sygnia); rebranded Sleepless Threat in September 2026 (per Ransom-ISAC); possible Conti offshoot (unconfirmed, per Unit 42)
- Regions targeted
- United States, United Kingdom
What each vendor calls it
- Google / Mandiant
- UNC3753
Also known as Silent RansomSilentRansomGroupTG2729
Profile
Luna Moth, which the FBI calls the Silent Ransom Group (SRG), is a data-theft extortion crew that doesn’t use ransomware at all, despite the name. It phones people. Sygnia named it Luna Moth (and TG2729) in July 2022 and dated its first campaign to late March of that year; the FBI lists Chatty Spider (CrowdStrike) and UNC3753 (Mandiant) as other names for the same group. No government has attributed it to a country, and no members have been publicly charged. Unit 42 noted claims that Silent Ransom grew out of the Conti ransomware operation but said it could not confirm the tie.
The original trick was callback phishing. Emails with a PDF invoice for a fake Duolingo, MasterClass or similar subscription urged the recipient to call a number to cancel the charge. The person on the phone then walked the victim into installing a legitimate remote-access tool such as AnyDesk, Atera, Splashtop, Syncro or Zoho Assist, and the operator copied files out by hand with Rclone or WinSCP. Sygnia found the group’s phishing domains often lasted only hours. Because nothing malicious ever touches the disk, antivirus rarely notices; Unit 42 noted the group skips malware entirely.
Since spring 2023 the group has concentrated on US law firms, the FBI says, likely because client files are so sensitive. In March 2025 it switched lures: EclecticIQ found at least 37 freshly registered domains styled as company IT help desks, and the FBI’s May 2025 notice described operators calling staff while posing as their own IT department. The FBI also warned that the group had sent a person in to a firm’s office, posing as IT support, to plug a storage device into a computer. A May 2026 FBI alert said the in-person visits are now the fallback when a remote session is refused, with data copied straight onto a USB or external drive.
The money is real. In October 2026 four files from inside the group leaked online, including about 5,700 chat messages from August 2025 to September 2026. Ransom-ISAC judged the leak most likely authentic and found the group’s own books confirmed at least $43.95 million received from 27 paying firms, with a much larger total it rated probable. About 88% of the roughly 33 named targets were law firms, the rest accounting, insurance and healthcare businesses in the US and UK. The group ran its own 3CX phone servers and Rocket.Chat server, and in September 2026 rebranded as Sleepless Threat. Check Point, looking at the same material, counted 42 law firms among the group’s 50 most recent victims and stressed that who leaked it, and why, is unknown.
The leaked chats also talk about planting fake employees at targets, physical break-ins and going after military personnel. Ransom-ISAC and Check Point both treat that as claimed or possible, not confirmed, and Ransom-ISAC says the newest activity may come from a splinter group. What is well documented is simpler: a phone call, a remote session and a manual file grab, followed by extortion emails and calls to the victim’s staff and clients. Demands reported by EclecticIQ ran from $1 million to $8 million.
Events
| Date | Target | Narrative | Source | Our coverage |
|---|---|---|---|---|
| 2026-10 | Mostly US law firms, plus accounting, insurance and healthcare firms in the US and UK | Analysis of leaked internal files: calls posing as IT or a vendor, T1566.004 (Phishing: Spearphishing Voice), AnyDesk sessions, T1219.002 (Remote Access Tools: Remote Desktop Software), manual copying to Google Drive, T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage), and Bitcoin demands. At least $43.95 million confirmed received from 27 firms. | Ransom-ISAC | Our story |
| 2026-10 | Law firms, business services, finance and real estate | Check Point reviews the same leak: 42 of the 50 most recent victims are law firms; talk of fake-employee placement is weakly evidenced. | Check Point | |
| 2026-08 | 15 or more firms | Mass vishing push against at least 15 firms in a single day, recorded in the leaked chats. | Ransom-ISAC | Our story |
| 2026-05 | US law firms; also insurance, finance and healthcare companies | FBI FLASH: SRG poses as IT support by phone and email; if a remote session is refused, it sends someone to the office to plug in a drive, T1052.001 (Exfiltration Over Physical Medium: Exfiltration over USB), then pressures staff and clients by phone. | FBI | |
| 2025-05 | US law firms | FBI Private Industry Notification: since April 2025 SRG calls staff posing as their IT department and has sent a person on site to insert a storage device; exfiltration via WinSCP or a renamed Rclone. | FBI | |
| 2025-03 to 2025-05 | US legal and financial services firms | EclecticIQ finds at least 37 GoDaddy-registered help-desk lookalike domains and abuse of Syncro, SuperOps, Zoho Assist, Atera, AnyDesk and Splashtop. | BleepingComputer (citing EclecticIQ) | |
| 2023 (spring) | US law firms | The FBI dates the group’s consistent focus on US law firms to this period. | FBI | |
| 2022-11 | Businesses in several sectors, including legal and retail | Unit 42 documents the callback-phishing campaign: fake invoice PDFs, phone agents, remote-management tools and manual exfiltration, with losses in the hundreds of thousands of dollars. | Unit 42 | |
| 2022-03 to 2022-07 | Organizations receiving fake subscription invoices | Sygnia names Luna Moth (TG2729): Zoho MasterClass and Duolingo invoice lures, AnyDesk, Atera, Splashtop and Syncro for access, Rclone uploads to short-lived .xyz domains. | Sygnia |
Target vectors risk profile
| Ransomware/extortion | Legal | Finance | Insurance | Healthcare | Accounting | Retail/POS | Physical access | Cloud/identity | Government | Espionage |
|---|---|---|---|---|---|---|---|---|---|---|
| High | High | Medium | Medium | Medium | Medium | Low | Medium | Low | N/A | N/A |
Malware and tools
| Name | What it does | Public detection | Hunt Leads | Reports |
|---|---|---|---|---|
| AnyDesk, Zoho Assist, Atera, Splashtop, Syncro, SuperOps, Quick Assist, RustDesk | Legitimate remote-access and management tools the victim is talked into installing; no malware is used | Many published Sigma rules for RMM installs (SigmaHQ) | 4 Hunt Leads | FBI, Sygnia |
| Rclone, WinSCP | File-transfer tools, often renamed or run portable, used to copy data out by hand | Many published Sigma rules (SigmaHQ) | 4 Hunt Leads | FBI |
| 3CX PBX, Rocket.Chat | Group-run phone system for the calls and chat server for coordinating operators | Infrastructure indicators in Ransom-ISAC’s report | 4 Hunt Leads | Ransom-ISAC |
Reports
| Date | Source | Report |
|---|---|---|
| 2026-10-26 | Ransom-ISAC | Silent Ransom Group: leak analysis |
| 2026-10-09 | Check Point | How Luna Moth runs data extortion like a business |
| 2026-05-26 | FBI | Silent Ransom Group impersonating IT personnel through social engineering (FLASH-20260526-01) |
| 2025-05-23 | FBI | Silent Ransom Group targeting law firms (PIN 20250523-001) |
| 2025-05-05 | BleepingComputer | Luna Moth extortion hackers pose as IT help desks to breach US firms |
| 2022-11-21 | Unit 42 | Threat assessment: Luna Moth callback phishing campaign |
| 2022-07-01 | Sygnia | Luna Moth: the threat actors behind recent false subscription scams |
Vulnerabilities exploited
| Vulnerability | CVSS | Severity | Publisher | Platform | CISA KEV |
|---|---|---|---|---|---|
| None reported |
If you’re in their sights
Do this now
- Make it a firm rule that nobody installs remote-access software for a caller they didn’t contact. Hang up and call IT or the vendor back on a number you already have. Brief assistants and front-desk staff first; they usually get the call.
- Block remote-management tools IT hasn’t approved (AnyDesk, Zoho Assist, Atera, Splashtop, Syncro and the rest) and alert when one is installed, especially from a Downloads or temp folder.
- Verify anyone who turns up claiming to be from IT before they touch a computer, and disable or alert on USB storage on machines that hold client files.
- Watch for bulk uploads to personal cloud storage and for Rclone or WinSCP running on user workstations.
- Flag inbound email from lookalike “help desk” domains that imitate your firm’s name. If you’re targeted, report it to ic3.gov.
Compiled from FBI notices, Sygnia, Unit 42, EclecticIQ (via BleepingComputer), Ransom-ISAC and Check Point, plus ThreatRoundup reporting. Last reviewed November 1, 2026.
ThreatRoundup coverage
1 of these story has Hunt Leads: detection-ready leads for threat hunters.