Loading malware…
Luna Moth is a financially motivated threat actor cluster, also tracked as Silent Ransom Group, UNC3753, and Storm-0252. The provided content states that since March 2025 it has intensified callback phishing campaigns targeting U.S. legal, financial, and accounting firms. Its tradecraft includes use of legitimate tools, real-time social engineering, abuse of the Reamaze helpdesk platform, and remote monitoring and management (RMM) tools. The reporting explicitly describes this activity as 'zero malware,' indicating intrusion and extortion operations conducted without deploying traditional malware payloads. The objective described is extortion, including multi-million-dollar ransom demands, against high-trust institutions in the United States.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Luna Moth is an active ransomware group, ranking among the top in attack volume in May 2025.
From Callback Phishing to Extortion: Luna Moth Abuse Reamaze Helpdesk and RMM Tools Against U.S. Legal and Financial Sectors
Luna Moth is a financially motivated threat actor that conducts callback phishing campaigns using social engineering and legitimate remote monitoring and management (RMM) tools to gain access to victim networks. They exfiltrate data and extort victims by threatening to leak stolen files, but do not deploy traditional malware or ransomware encryption. Their operations focus on data theft and extortion, leveraging live operators and AI chatbots to trick victims into installing RMM tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.