SYMBOLCOMMON_NAMEaka. SYNONYMS

Luna Moth  (Back to overview)

aka: Silent Ransom, TG2729

Luna Moth conducts high-tempo callback phishing campaigns targeting legal and financial organizations in the U.S., using social engineering to lure victims into calling fake helpdesk numbers. Attackers impersonate IT staff to install legitimate RMM tools, enabling direct access to victim systems for data exfiltration. The group demands ransoms between $1 million and $8 million, threatening to leak stolen data if payments are not made. Their operations reflect a shift from traditional ransomware tactics to data breach extortion, leveraging trusted systems to evade detection.


Associated Families

There are currently no families associated with this actor.


References
2022-11-21Palo Alto Networks Unit 42Kristopher Russo
Threat Assessment: Luna Moth Callback Phishing Campaign
BazarBackdoor Conti Luna Moth

Credits: MISP Project