A massive trove of leaked internal documents has peeled back the curtain on the clandestine operations of a prolific ransomware syndicate, revealing an organization that functions less like a loose collection of hackers and more like a highly structured, corporate-style extortion enterprise. The analysis, conducted by security researchers at Check Point, provides a rare, granular look into the inner workings of the group known as Luna Moth—also identified by the cybersecurity community as the Silent Ransom Group (SRG) or, alternatively, by the threat intelligence designation Chatty Spider (UNC3753).
The documents, which surfaced on an anonymous onion site dubbed "The Luna Moth Files" in early October 2026, contain a wealth of internal communications, including chat logs and instructional materials. These files offer unprecedented insight into the group’s methodology, specifically highlighting the psychological manipulation tactics they employ to compromise enterprise networks. Rather than relying solely on traditional technical exploits or zero-day vulnerabilities, Luna Moth has built its reputation on a foundation of social engineering, meticulously grooming its victims until they willingly grant the keys to their corporate kingdom.
The Anatomy of a Modern Extortion Business
The Check Point report, published on October 9, characterizes the leaked data as a roadmap of the group’s operational hierarchy. The documents suggest that Luna Moth operates with a clear division of labor, where "staff" members are assigned specific roles in a multi-staged extortion lifecycle. This lifecycle begins long before the first line of code is executed or a file is encrypted; it starts with reconnaissance and planning.
Criminal operators within the group spend significant time identifying high-value targets, conducting thorough research to understand the organizational context of their victims. This diligence ensures that when the initial contact is made, the attackers possess enough background information to sound entirely legitimate. By mirroring the professional jargon and internal processes of the target organization, the attackers bridge the gap between a random scam call and a credible request, successfully lowering the victim’s natural defenses.
The core of their operation hinges on a sophisticated ruse: posing as internal IT support or security personnel. By adopting these personas, the attackers gain the trust necessary to convince employees to install or initiate remote access software. Once a victim is coaxed into running these legitimate remote management tools, the attackers effectively bypass perimeter security defenses. From there, they gain a foothold within the network, moving laterally to escalate privileges and, eventually, exfiltrating sensitive data to use as leverage for extortion.
Scripting the Psychological Attack
One of the most revealing aspects of the leaked files is the inclusion of detailed scripts designed to guide the attackers through their interactions with victims. These scripts are not merely templates for technical support; they are psychological playbooks that account for a wide range of human reactions.
The documents demonstrate that the group has carefully analyzed common points of resistance. Whether a target is skeptical, hurried, or naturally suspicious of an unsolicited request, the scripts provide the attacker with specific, pre-approved responses designed to diffuse tension and reinforce the ruse. This suggests that the members of Luna Moth are trained in the art of behavioral manipulation, treating every interaction as a high-stakes sales call where the product is a malicious connection and the price is the victim’s security.
The instructions even delve into how to handle situations where a victim demands verification or questions the identity of the caller. By anticipating these objections, the attackers ensure that they remain in control of the conversation, maintaining a calm, authoritative, and helpful demeanor that is the hallmark of effective social engineering.
IT Support for Cyber-Criminals
Perhaps the most startling revelation from the leaked logs is that the person on the phone is rarely acting alone. The documents outline a coordinated "team" approach to the intrusion process. While one operative is occupied with the emotional labor of keeping the victim calm and cooperative on the phone, a second operative—often a more technically proficient "keyboard attacker"—is simultaneously managing the remote access session.
These two roles are synchronized through private messaging platforms, allowing for a seamless transition from the verbal deception to the technical execution. The "social engineer" acts as the front man, keeping the victim distracted and engaged, while the "hands-on" attacker works in the background to navigate the file system, harvest credentials, or deploy additional malware.
This symbiotic relationship allows the group to operate with remarkable speed. Because the victim is being coached by a perceived professional on the phone, they are often oblivious to the fact that their machine is being compromised in real-time by a second, unseen actor. The Check Point report notes that this structure elevates Luna Moth from a typical ransomware crew to a specialized data-extortion entity, where the core platform is the manipulation of human trust rather than just technical vulnerabilities.
The security researchers emphasize that if these files are authentic, they represent a significant shift in the threat landscape. Traditional cybersecurity measures—such as firewalls, endpoint protection, and intrusion detection systems—are often blind to these attacks because the victim is essentially granting the attacker legitimate access. When a user provides their own credentials or invites a malicious actor to connect via an approved remote support tool, the technical controls are effectively bypassed from the inside out.
Protecting the Human Element
The implications of the Luna Moth model are clear: organizations cannot rely solely on automated defenses to protect their environments. Because the threat is fundamentally human-centric, the defense must be as well. The researchers at Check Point have cautioned that as long as attackers focus on exploiting the human tendency to trust, technical solutions will remain only one part of a comprehensive security strategy.
To combat this, organizations are urged to implement rigorous verification protocols. Employees should be trained to view any unexpected request for remote access or technical assistance with extreme skepticism. A "verify, then trust" policy should be enforced, requiring staff to confirm the legitimacy of any IT support request through a separate, known, and pre-authorized channel before granting any access. If an employee receives a call from "IT," they should be encouraged to hang up and call the help desk back using a verified internal extension or official contact method.
Furthermore, organizations should strictly limit the types of remote access tools that can be installed or run on company machines. By restricting the availability of these tools, IT departments can prevent unauthorized remote connections from being initiated, even if an employee is successfully tricked into attempting one. Limiting administrative privileges also serves as a critical secondary defense, ensuring that even if an attacker gains initial access, their ability to escalate privileges and move laterally through the network is severely curtailed.
The exposure of the Luna Moth internal operations serves as a stark reminder of the evolving nature of cybercrime. As the industry continues to harden its technical infrastructure, sophisticated groups are increasingly pivoting toward the human element. The business-like structure of Luna Moth—with its scripts, training, and coordinated team roles—highlights an adversary that is not just technically capable, but operationally disciplined. Protecting against such threats requires a cultural shift within the workplace, where security is treated as a shared responsibility rather than an afterthought, and where the human firewall is bolstered by clear policies and an environment of healthy skepticism.
