Luna Moth Leak Reveals Ransomware Group's Inner Workings

Check Point analyzed leaked documents from the Luna Moth group (Silent Ransom Group), revealing a two-person social engineering scheme where one attacker talks to victims posing as IT support while another gains remote access. The files, leaked in early October 2026, include manipulation scripts and role division.

• Luna Moth files leaked to an onion site in early October 2026
• Attacks start with planning and a call posing as IT support
• One attacker speaks to the victim while another gains remote access
• Check Point advises verifying IT requests via a separate channel