Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings

Leaked internal files expose Luna Moth's phone-based social engineering operation, where paired callers and remote-access operators extort victims' data.

Files leaked to an onion site called 'The Luna Moth Files' in early October 2026 exposed internal documents and chat logs of Luna Moth, also tracked as Silent Ransom Group, Chatty Spider, and UNC3753. Check Point's October 9 analysis shows a division of labor in which one criminal keeps the victim calm on the phone while an accomplice operates remote access software to enter the network. Staff follow scripts handling victim resistance, and the operation escalates privileges to steal confidential data used for blackmail. Check Point characterizes the group as a specialized data-extortion business built on coordinated trust manipulation.