SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Leaked Luna Moth files show one operator on the phone while a second drives the remote session
Check Point's October 9 analysis of leaked Luna Moth files describes one operator calming the victim by phone while another runs the remote session. The files surfaced on an anonymous onion site and Check Point words its conclusion conditionally, so the call pattern is usable for training but unverified.
The Watch · Security desk
The leaked files appear to suggest one operator speaks to and calms the victim while another uses the remote software. A caller posing as IT support asks the employee for remote access, which gives initial network access. Employees are advised to verify IT requests via a separate channel.
- capability Operator on the phone Speaks to the victim to reassure and calm them, the leaked files appear to suggest, claim 12
- capability Operator on the remote tool Uses the remote software, coordinating with the caller over a group messaging service, claim 12
- exposure Targeted employee Caller often poses as IT support or an IT security worker to get remote access to their computer, claim 7
- exposure The network Remote access gives initial access, which can be abused to move around and escalate privileges, claim 8
- decision Employees Advised to verify unexpected IT requests via a separate, known channel before approving a remote session, claim 5
| Who | How | Kind | Claim |
|---|---|---|---|
| Operator on the phone | Speaks to the victim to reassure and calm them, the leaked files appear to suggest | capability | 12 |
| Operator on the remote tool | Uses the remote software, coordinating with the caller over a group messaging service | capability | 12 |
| Targeted employee | Caller often poses as IT support or an IT security worker to get remote access to their computer | exposure | 7 |
| The network | Remote access gives initial access, which can be abused to move around and escalate privileges | exposure | 8 |
| Employees | Advised to verify unexpected IT requests via a separate, known channel before approving a remote session | decision | 5 |
What happened
- The files appeared in early October 2026 on an anonymous onion site called "The Luna Moth Files" and claim to hold the group's internal files and chat logs.
- The operation starts with planning: operators pick targets and gather business context so first contact looks legitimate before the victim is moved to a phone call.
- On the call, the attacker often poses as IT support or an IT security worker and asks the target to grant remote access through a remote access tool.
- The documents give attackers scripts that anticipate common victim responses, including advice for handling a victim who distrusts or resists the caller.
Why it matters
- exposure Any employee who can approve a remote session is the entry point. Once the session is open, the attacker can move around the network and escalate privileges.
- constraint Check Point's researchers warned that technical controls alone will not stop this activity, because the target of the attack is the person on the phone.
- decision Help desk and staff training now has a specific scenario to rehearse: a calm caller who knows the business, with a second person already waiting on the remote tool.
The two operators talk to each other while the call is live. According to the leaked files as Infosecurity Magazine describes them, they coordinate over a group messaging service [12]. That gives a defender one concrete picture of the call: a calm voice on the line, and a second person working the machine in the background.
Check Point's summary treats the group as a business. "If authentic, the exposure shows that Luna Moth should be understood less as a conventional ransomware crew and more as a specialized data-extortion business whose core platform is the coordinated manipulation of trust," the Check Point report said [9]. The conditional is Check Point's own. The stated purpose of the operation, per the analysis, is to steal confidential information and extort payment through blackmail [10]. The group is also tracked as Silent Ransom Group and as Chatty Spider UNC3753 [2].
The recommended steps are two. Employees should confirm any unexpected IT request through a separate, known channel before approving a remote session, and organizations should limit which remote access tools employees can install [5]. We think the two steps map onto the two roles. A callback on a channel the employee already trusts takes the conversation away from the caller. A short list of permitted tools removes the software the second operator needs.
The Infosecurity Magazine write-up does not say how the first contact reaches victims, how many organizations were hit, or whether the two-person call is new for the group. Training built on this material covers the phone call. It does not yet cover whatever precedes it.
What to watch
- Whether Check Point or another vendor confirms or disputes that The Luna Moth Files are authentic.
- Whether further analysis shows how first contact reaches victims before the phone call.
- Whether the onion site posts more material beyond the early October 2026 release.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Leaked files were posted to an anonymous onion site called "The Luna Moth Files" in early October 2026 and claim to contain internal files and chat logs of Luna Moth.
- [2]
Luna Moth is commonly also known as Silent Ransom Group and is tracked by analysts as Chatty Spider UNC3753.
- [3]
Check Point researchers published their analysis of the Luna Moth files on October 9.
- [4]
Researchers warned that technical controls are not enough to keep organizations safe from cyber extortion activity that targets people directly in this way.
- [5]
Recommended steps include encouraging employees to verify any unexpected IT requests through a separate, known channel before approving a remote session, and limiting which remote access tools employees can install.
- [6]
The operation begins with a planning stage in which operators identify organizations and individuals to target and gather the business context needed so the initial contact appears legitimate before the victim is persuaded to communicate over the phone.
ReportedContestedSource: Infosecurity Magazine, citing Check Point's analysis of the leaked files2 sources— create a free account to open themView cited source - [7]
In many cases the attacker poses as IT support or an IT security worker to convince the target to provide remote access to their computer via a remote access software tool.
ReportedContestedSource: Infosecurity Magazine2 sources— create a free account to open themView cited source - [8]
Remote access gives the attacker initial access to the network, which can be abused to move around and escalate privileges.
ReportedContestedSource: Infosecurity Magazine2 sources— create a free account to open themView cited source - [9]
"If authentic, the exposure shows that Luna Moth should be understood less as a conventional ransomware crew and more as a specialized data-extortion business whose core platform is the coordinated manipulation of trust," said the Check Point report.
ReportedContestedSource: Check Point report, quoted by Infosecurity Magazine2 sources— create a free account to open themView cited source - [10]
The Silent Ransom Group operations are designed to steal confidential information and extort financial payments from victims using blackmail.
ReportedContestedSource: Infosecurity Magazine, citing Check Point's analysis2 sources— create a free account to open themView cited source - [11]
According to the leaked documents, attackers are given scripts that account for common victim responses, including advice on handling a victim who is distrusting or resistant.
- [12]
The documents appear to suggest that one individual speaks to the victim to reassure and calm them while another individual uses the remote software, and according to the leaked files the two coordinate over a group messaging service.
Sources
1 independent publisher whose own reporting we read for this story.
- infosecurity-magazine.comLuna Moth Leaks Shed Light on Ransomware Group's Inner Workings
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.