Loading malware…
Luna Moth, also tracked as Silent Ransom, is a financially motivated extortion threat active since at least 2022 that is known for data-theft-led operations centered on social engineering rather than conventional ransomware deployment. The group has been repeatedly associated with campaigns against professional services organizations, especially law firms, and has also targeted insurance-sector victims. Its operations emphasize direct interaction with employees, commonly through callback phishing and voice-based impersonation of internal IT staff or third-party help desks, to persuade targets to install legitimate remote assistance software. This gives the operators hands-on-keyboard access to victim workstations, where they search for and steal sensitive information for later extortion.
Unlike many ransomware crews, Luna Moth has been described as relying exclusively or predominantly on social engineering for initial access and often focusing on one compromised workstation rather than broad enterprise-wide intrusion. In some cases it has accessed a small number of workstations over extended periods. Reported tradecraft includes use of remote administration tools to obtain interactive access, theft of sensitive legal and business records, and threats to publicly expose stolen data to coerce payment. The group is therefore better characterized as a data-extortion actor than as a classic encryption-focused ransomware operator, even though it is often discussed within the broader ransomware ecosystem.
Luna Moth has been observed as a notable driver of large extortion payments in campaigns against high-profile law firms. Reporting also links the group to callback-phishing operations and, in some cases, in-person impersonation of IT personnel to gain workstation access. It has been mentioned among successor or splinter operations that emerged after the decline of the Conti ecosystem. The actor’s tradecraft reflects a broader shift in cyber extortion toward identity abuse, remote access compromise, and exfiltration-focused monetization with limited operational disruption compared with traditional big-game ransomware attacks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data-theft-focused extortion group that targets law firms, using social engineering, vishing, and even physical impersonation of IT personnel to gain access and steal sensitive legal records for extortion.
Silent Ransom, also known as Luna Moth, is a group that uses callback phishing and targets specific industries such as insurance and law firms, focusing on data exfiltration and extortion.
A social-engineering-driven extortion operation active since 2022 that impersonates IT support to trick employees into installing remote assistance tools, then steals sensitive data from a small number of workstations without broad lateral movement or operational disruption.
Ransomware name mentioned as a successor/related operation after Conti’s shutdown.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.