Luna Moth leaks reveal social engineering scripts and team tactics
Check Point researchers analyzed leaked files showing how the ransomware group uses coordinated phone calls to steal remote access credentials.
Key points
- Leaked documents from The Luna Moth Files expose internal operational scripts for the Silent Ransom Group.
- Attackers use a two-person team model where one social engineer distracts the victim while another gains access.
- Check Point published its analysis of these tactics on October 9, 2026, detailing the group's businesslike approach.
Leaked internal documents have revealed the operational playbook of the Luna Moth ransomware group, showing how the organization coordinates social engineering and technical attacks. According to an analysis by Check Point researchers published on October 9, 2026, the group uses structured scripts to manipulate victims into granting remote access to enterprise systems.
The files, which appeared on an anonymous onion site called The Luna Moth Files in early October 2026, contain chat logs and instructions for staff. These documents identify the group as Luna Moth, also known as Silent Ransom Group (SIG) and tracked by analysts as Chatty Spider UNC3753. The leaks provide a detailed look at the division of labor between social engineers and hands-on keyboard attackers.
Operational Tactics and Scripts
The leaked materials describe a multi-layered operation designed to steal confidential information and extort payments. The process begins with a planning stage where operators identify target organizations and gather business context. This preparation ensures that initial contact appears legitimate before the attacker attempts to persuade the victim to communicate over the phone.
Attackers typically pose as IT support or security workers. They use this persona to convince targets to provide remote access via specific software tools. Once access is granted, the attacker can move laterally within the network and escalate privileges. The documents include scripts that guide callers on how to handle resistant or distrustful victims, ensuring the conversation remains productive for the criminal operation.
Coordinated Attack Structure
A key finding from the Check Point analysis is the collaborative nature of the attacks. The documents suggest that the person speaking to the victim is not acting alone. While one individual engages the victim to keep them calm and reassured, a second individual simultaneously operates the remote access software. This separation of duties allows the social engineer to focus entirely on emotional manipulation while the technical attacker secures the foothold.
This structure highlights a businesslike approach to cybercrime, where roles are clearly defined to maximize efficiency. The group treats the intrusion as a coordinated project rather than a solo effort. By splitting the interaction, they reduce the risk of errors during the critical moment of access acquisition. The scripts provided to staff account for common victim reactions, allowing the team to adapt their strategy in real time during the call.
What should you do?
Security teams should review their remote access policies and ensure that IT support requests are verified through independent channels. Organizations should train employees to recognize the pressure tactics described in the leaked scripts, such as urgency or reassurance from unknown callers. Monitoring for unusual remote access sessions can help detect these coordinated intrusions early.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Luna Moth
- Verify all remote access requests through a separate, trusted communication channel before granting any permissions.
- Implement multi-factor authentication for remote administration tools to prevent unauthorized access even if credentials are compromised.
- Train staff to recognize social engineering scripts that involve simultaneous technical actions and emotional reassurance.
- Monitor network logs for unexpected privilege escalations or lateral movement following any remote support interactions.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the Luna Moth ransomware group also known as?
The group is also tracked as Silent Ransom Group (SIG) and Chatty Spider UNC3753, according to the Check Point analysis.
How do Luna Moth attackers gain initial access to networks?
They use social engineering to pose as IT support and convince victims to provide remote access via software tools.
What is unique about the team structure revealed in the leaks?
The attacks involve two people: one social engineer who talks to the victim and another who operates the remote access software.
