Luna Moth retargets law firms to steal Microsoft access tokens
Original title: Extortion Group Luna Moth Flits Into Law Firms a Second Time
ReliaQuest says the group returns weeks to months later, likely against firms that refused the first demand.
ReliaQuest says the data-extortion group Luna Moth is again targeting law firms it has pursued since at least mid-2023. Attackers send a black-subject email from a free address with a PDF that fails to open, then call posing as IT support and move victims to a video call and screen sharing to obtain Microsoft access tokens and steal data. Researchers say the group has dropped remote-management tools and manual exfiltration used in earlier attacks.
Unconfirmed: ReliaQuest says the new targets are “likely” prior non-payers; that selection claim is the firm’s assessment.
- ReliaQuest says the second wave is likely firms that did not pay.
- Earlier attacks used Windows remote assistance to download data directly.
- A spokesperson says sensitive client data makes a second attempt worthwhile.
- The published account cuts off during the screen-share stage of the call.
Impact: theft of Microsoft access tokens and data
- 1.Treat IT-support calls that follow a failed business-report PDF as suspicious.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1566.004 Spearphishing VoiceT1528 Steal Application Access Token
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- Luna Moth
- Organizations
- ReliaQuest
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 515ba38b217dc05b34b6893d9aee3a44 | e-ads-spyware-delivery#recipe=similar-items&sourcecontentid=515ba38b217dc05b34b6893d9aee3a44) 'AdFection' Turns Online Ads Into Spyware Delivery Tool b |
| md5 | 7486718f7a62752999d0495329bf013f | vacy-labels-not-enough#recipe=similar-items&sourcecontentid=7486718f7a62752999d0495329bf013f) Inconsistent Privacy Labels Don't Tell Users What They Ar |
| md5 | d9df486703c0658d61328abeecea24e8 | -enterprises-end-users#recipe=similar-items&sourcecontentid=d9df486703c0658d61328abeecea24e8) While ECH Adoption Is Low, Risks Remain for Enterprises, |
| md5 | fcc5c720b642b003df09dd8e9b6fae56 | ry-launches-dna-shield#recipe=similar-items&sourcecontentid=fcc5c720b642b003df09dd8e9b6fae56) Biomemory Launches DNA Shield, First Commercial Product B |
From the original article
7 min read at darkreading.com
The cybercriminals are re-targeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.