In an unverified leak, Luna Moth's callers keep victims talking while a partner runs the remote session

The vishing document is the most specific item in the archive. It tells the caller to watch a separate group chat for the whole remote session and to pass on any change in the victim's behavior ^[10]. From that instruction, Check Point concludes that a second operator is working on the endpoint ^[10]. "In this workflow, the call acts as a control channel," Check Point wrote ^[22]. The chats also mention virtual servers set up for 3CX telephony ^[11].

The tradecraft matches the public record. In 2022, Unit 42 documented the group sending personalized subscription invoices that pointed recipients to attacker-controlled phone numbers ^[6]. Those calls ended with victims starting remote support sessions on legitimate administration software ^[6]. Mandiant later described the group impersonating a victim's own IT staff. The cover story was a help-desk issue or a data migration. The tools were screen sharing, legitimate remote administration software and file-sharing services meant for consumers ^[7]. The leak adds detail on how callers are coached ^[13]. According to Check Point, the script moves through anxiety, then reassurance, then renewed urgency, and presents remote access as a protective security check ^[13].

Callers arrive prepared. Early messages discuss long-lived domains, business email accounts and simple commercial-looking websites ^[12]. Other messages cover registering with commercial services that sell data on individuals, then lists of senior staff and requests for the calling to begin ^[12]. Check Point's assessment is that the caller ends up with an identity that survives basic scrutiny ^[23].

Little in this chain looks like malware ^[25]. SRG generally skips encryption. It persuades people to grant access, steals sensitive data and threatens to publish or sell it ^[5]. The archive contains no new exploit and no new malware ^[4]. The remote session runs on legitimate software that the victim starts because the caller asked ^[6]. On this evidence, the chain can be broken at two points. Staff can confirm an IT caller through a channel the caller did not supply, and the organization can limit which remote-support tools run on staff machines ^[25].

The chats state the legal focus outright. Participants refer repeatedly to the legal sector and to an ambition to target the top 100 law firms in the world ^[15]. Across Check Point's broader victim dataset, Business Services accounts for 69 classifications, Finance for 22 and Real Estate for two ^[17].

The callback and IT-impersonation pattern is documented in Unit 42 and Mandiant reporting ^[6][7]. The leak's origin is unknown. The package holds chat exports, a vishing document, screenshots and a purported resume ^[2]. Nobody knows who posted it or how the archive was obtained, and Check Point treats its claims as unverified until independent sources back them up ^[3]. Claims about operator identities, confirmed payments and deepfake use still need that corroboration, according to Check Point ^[21].

The same caution applies to activity beyond the phone. The chats discuss recruitment, prospective agents and a project called "Fake_Employee," and the site lists a purported resume sent to law firms ^[18]. Check Point rates the evidence as strongest for internal discussions and project concepts and weaker for any successful placement of a fake employee ^[19]. Separately, the FBI has reported that impostors claiming to be IT staff tried to get in physically once their remote attempts had failed ^[8].