CHECK Point researchers have analysed leaked files from an anonymous onion site, “The Luna Moth Files”, which purportedly contain internal documents and chat logs from a major ransomware gang known as Luna Moth, Silent Ransom Group (SIG) and tracked as Chatty Spider UNC3753. The materials portray a multi-layered, businesslike operation that treats data extortion as a service-like activity rather than a lone criminal endeavour. The documents shed light on how the group organises its workflow, from planning targets to exploiting victims by social engineering and remote access.
The analysis outlines how the operation begins with identifying targets and crafting convincing pretexts to ensure legitimacy before contact. In many cases the attacker poses as IT support or an IT security worker to persuade victims to grant remote access via a remote access tool, enabling initial access and later lateral movement or privilege escalation.
The leaked scripts indicate how staff are coached to respond to common objections and how a second operator remotely executes the intrusion while a third party coordinates via group chat. Researchers emphasise that this is less a traditional ransomware crew and more a data-extortion business model built on trust manipulation.
In terms of defence, the report cautions that technical controls alone are insufficient; organisations should reinforce staff verification of unexpected IT requests through a separate channel and restrict which remote tools can be installed.