Luna Moth
Aliases: Silent Ransom, TG2729
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:21:50
Targeted industries: financial-services professional-services
Targeted regions: country_code:us
Context
Luna Moth conducts high-tempo callback phishing campaigns targeting legal and financial organizations in the U.S., using social engineering to lure victims into calling fake helpdesk numbers. Attackers impersonate IT staff to install legitimate RMM tools, enabling direct access to victim systems for data exfiltration. The group demands ransoms between $1 million and $8 million, threatening to leak stolen data if payments are not made. Their operations reflect a shift from traditional ransomware tactics to data breach extortion, leveraging trusted systems to evade detection.
Reports & references
- blog.eclecticiq.com — From Callback Phishing To Extortion Luna Moth Abuse Reamaze Helpdesk And Rmm Tools Against U.S. Legal And Financial Sectors (report)
- Palo Alto Unit 42 — Luna Moth Callback Phishing (report)