Dark ReadingAlexander Culafi
Luna Moth returns to law firms to steal Microsoft tokens
Part of the Luna Moth story · since 7 Apr
- Tue 7 Apr, 03:01 UTC. DataBreaches, first report. Jones Day confirms breach after Silent Ransom Group phishing.
- Fri 10 Apr, 15:07 UTC. DataBreaches. Law firm Orrick hit by SRG hack, data leaked after ransom talks.
- Mon 13 Apr, 17:21 UTC. DataBreaches. Silent Ransom Group targets US law firms, leaks data from 38+.
- Wed 27 May, 08:51 UTC. SecurityWeek, its first report on the story. FBI warns Silent Ransom Group targeting US law firms via phishing.
- Wed 27 May, 13:21 UTC. DataBreaches. FBI Warns of Silent Ransom Group Targeting US Law Firms.
- Wed 27 May, 21:21 UTC. Dark Reading, its first report on the story. FBI warns Silent Ransom Group targets law firms with IT scams.
- Fri 29 May, 13:10 UTC. Infosecurity, its first report on the story. Ransomware gang poses as IT staff to hit US law firms.
- Fri 5 Jun, 18:31 UTC. Security Affairs, its first report on the story. FBI warns that Silent Ransom Group uses IoT devices in attacks.
- Sun 7 Jun, 19:30 UTC. DataBreaches. Silent Ransom Group spurns $1.8M demand, leaks law firm data.
- Mon 8 Jun, 10:40 UTC. SecurityWeek. Silent Ransom Group uses fast flux to hit law firms worldwide.
- Mon 8 Jun, 11:50 UTC. Security Affairs. UNC3753 gang uses vishing and USB drops to steal legal data.
- Mon 8 Jun, 21:30 UTC. Dark Reading. Silent Ransom Group Targets Law Firms Using Vishing to Steal Data.
- Mon 29 Jun, 23:06 UTC. DataBreaches. Silent Ransom Group hits Fox Rothschild, leaks law firm data.
- Fri 21 Aug, 17:06 UTC. DataBreaches. Troutman Pepper Locke Suffers Second Silent Ransom Attack.
- Mon 14 Sep, 13:41 UTC. DataBreaches. Ransom Group Claims Greenberg Traurig Breach Exposed 126,000 People.
- Mon 28 Sep, 17:47 UTC. DataBreaches. Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand.
- Wed 7 Oct, 22:36 UTC. DataBreaches. Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms.
- Fri 9 Oct, 14:36 UTC. DataBreaches. Researchers question whether the Luna Moth leak really came from Silent Ransom Group.
- Sat 10 Oct, 15:55 UTC. Security Affairs. Silent Ransom Group Extorted 27 Law Firms Without Using Malware.
- Sun 11 Oct, 14:01 UTC. DataBreaches. Unprotected MongoDB Backup Exposed Silent Ransom Group Chats.
- Mon 12 Oct, 15:37 UTC. Infosecurity. Leaked files reveal how Luna Moth scammers trick staff into granting remote access.
- Thu 12 Nov, 21:30 UTC. Dark Reading. Luna Moth returns to law firms to steal Microsoft tokens. This article, 22nd of 22.
ReliaQuest says the Luna Moth extortion group has returned to law firms it targeted before, likely focusing on those that rejected its first ransom demand. The second approaches have come weeks or months later and seek a fresh set of data. Rather than use remote-management tools to download files manually, the group is attempting to steal Microsoft access tokens through social engineering.
In the campaign, attackers send an email from a free account with a broken PDF presented as a business report. They then pose as IT support, claiming to respond to a malicious alert and offering to fix the file. During a video call, they ask the victim to share their screen, open Microsoft Copilot in a work browser and use developer tools to find and copy the access token sent to Microsoft Graph.
The victim is told to paste it into a public text-sharing site; attackers can then use the token with the Microsoft Graph API to access and download files. ReliaQuest says the method requires no malware or software vulnerability, and that it has observed the group targeting law firms since at least mid-2023.
ReliaQuest says the tactic can evade controls because the token is issued to a compliant device and handed over by the user, while the legitimate sign-in satisfies multi-factor authentication. The firm says bearer tokens can work from anywhere until expiry unless protections such as Continuous Access Evaluation (CAE) with strict location enforcement or token binding apply.
It recommends enabling CAE by default, blocking developer tools and token-inspection pages in managed browsers, restricting unnecessary remote-support and screen-sharing tools, and telling staff that IT should never ask for tokens or developer tools.
How the story developed
22 articles from 5 outlets since 7 Apr. Picked up again on 12 Nov after 4 weeks quiet. This was the 22nd report, 220 days after the first.
- Tue 7 Apr, 03:01 UTC. DataBreaches, first report. Jones Day confirms breach after Silent Ransom Group phishing.
- Fri 10 Apr, 15:07 UTC. DataBreaches. Law firm Orrick hit by SRG hack, data leaked after ransom talks.
- Mon 13 Apr, 17:21 UTC. DataBreaches. Silent Ransom Group targets US law firms, leaks data from 38+.
- Wed 27 May, 08:51 UTC. SecurityWeek, its first report on the story. FBI warns Silent Ransom Group targeting US law firms via phishing.
- Wed 27 May, 13:21 UTC. DataBreaches. FBI Warns of Silent Ransom Group Targeting US Law Firms.
- Wed 27 May, 21:21 UTC. Dark Reading, its first report on the story. FBI warns Silent Ransom Group targets law firms with IT scams.
- Fri 29 May, 13:10 UTC. Infosecurity, its first report on the story. Ransomware gang poses as IT staff to hit US law firms.
- Fri 5 Jun, 18:31 UTC. Security Affairs, its first report on the story. FBI warns that Silent Ransom Group uses IoT devices in attacks.
- Sun 7 Jun, 19:30 UTC. DataBreaches. Silent Ransom Group spurns $1.8M demand, leaks law firm data.
- Mon 8 Jun, 10:40 UTC. SecurityWeek. Silent Ransom Group uses fast flux to hit law firms worldwide.
- Mon 8 Jun, 11:50 UTC. Security Affairs. UNC3753 gang uses vishing and USB drops to steal legal data.
- Mon 8 Jun, 21:30 UTC. Dark Reading. Silent Ransom Group Targets Law Firms Using Vishing to Steal Data.
- Mon 29 Jun, 23:06 UTC. DataBreaches. Silent Ransom Group hits Fox Rothschild, leaks law firm data.
- Fri 21 Aug, 17:06 UTC. DataBreaches. Troutman Pepper Locke Suffers Second Silent Ransom Attack.
- Mon 14 Sep, 13:41 UTC. DataBreaches. Ransom Group Claims Greenberg Traurig Breach Exposed 126,000 People.
- Mon 28 Sep, 17:47 UTC. DataBreaches. Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand.
- Wed 7 Oct, 22:36 UTC. DataBreaches. Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms.
- Fri 9 Oct, 14:36 UTC. DataBreaches. Researchers question whether the Luna Moth leak really came from Silent Ransom Group.
- Sat 10 Oct, 15:55 UTC. Security Affairs. Silent Ransom Group Extorted 27 Law Firms Without Using Malware.
- Sun 11 Oct, 14:01 UTC. DataBreaches. Unprotected MongoDB Backup Exposed Silent Ransom Group Chats.
- Mon 12 Oct, 15:37 UTC. Infosecurity. Leaked files reveal how Luna Moth scammers trick staff into granting remote access.
- Thu 12 Nov, 21:30 UTC. Dark Reading. Luna Moth returns to law firms to steal Microsoft tokens. This article, 22nd of 22.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 22 articles as a listHide the list
- Tue 7 AprDay 01
- Jones Day confirms breach after Silent Ransom Group phishing03:01 · DataBreaches · First report
Quiet for 4 days
Fri 10 AprDay 31- Law firm Orrick hit by SRG hack, data leaked after ransom talks15:07 · DataBreaches · Picked up again
Quiet for 3 days
Mon 13 AprDay 61- Silent Ransom Group targets US law firms, leaks data from 38+17:21 · DataBreaches · Picked up again
Quiet for 6 weeks
Wed 27 MayDay 503- FBI warns Silent Ransom Group targeting US law firms via phishing08:51 · SecurityWeek · Picked up again
- FBI Warns of Silent Ransom Group Targeting US Law Firms13:21 · DataBreaches
- FBI warns Silent Ransom Group targets law firms with IT scams21:21 · Dark Reading
Quiet for 2 days
Fri 29 MayDay 521- Ransomware gang poses as IT staff to hit US law firms13:10 · Infosecurity
Quiet for 7 days
Fri 5 JunDay 591- FBI warns that Silent Ransom Group uses IoT devices in attacks18:31 · Security Affairs · Picked up again
Quiet for 2 days
Sun 7 JunDay 611- Silent Ransom Group spurns $1.8M demand, leaks law firm data19:30 · DataBreaches · Picked up again
- Mon 8 JunDay 623
- Silent Ransom Group uses fast flux to hit law firms worldwide10:40 · SecurityWeek
- UNC3753 gang uses vishing and USB drops to steal legal data11:50 · Security Affairs
- Silent Ransom Group Targets Law Firms Using Vishing to Steal Data21:30 · Dark Reading
Quiet for 3 weeks
Mon 29 JunDay 831- Silent Ransom Group hits Fox Rothschild, leaks law firm data23:06 · DataBreaches · Picked up again
Quiet for 8 weeks
Fri 21 AugDay 1361- Troutman Pepper Locke Suffers Second Silent Ransom Attack17:06 · DataBreaches · Picked up again
Quiet for 3 weeks
Mon 14 SepDay 1601- Ransom Group Claims Greenberg Traurig Breach Exposed 126,000 People13:41 · DataBreaches · Picked up again
Quiet for 2 weeks
Mon 28 SepDay 1741- Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand17:47 · DataBreaches · Picked up again
Quiet for 9 days
Wed 7 OctDay 1831- Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms22:36 · DataBreaches · Picked up again
Quiet for 2 days
Fri 9 OctDay 1851- Sat 10 OctDay 1861
- Silent Ransom Group Extorted 27 Law Firms Without Using Malware15:55 · Security Affairs
- Sun 11 OctDay 1871
- Unprotected MongoDB Backup Exposed Silent Ransom Group Chats14:01 · DataBreaches
- Mon 12 OctDay 1881
Quiet for 4 weeks
Thu 12 NovDay 2191- Luna Moth returns to law firms to steal Microsoft tokens21:30 · Dark Reading · Picked up again · This article, 22nd of 22