Executive Summary
Luna Moth, also known as Silent Ransom Group, is a highly disciplined extortion team that operates without the use of traditional ransomware cryptors. Their model relies on callback phishing—sending email lures that prompt victims to call a fraudulent helpdesk. Once on the phone, social engineering specialists manipulate employees into installing legitimate remote monitoring and management (RMM) tools such as Atera, Syncro, or AnyDesk, effectively bypassing traditional email and endpoint security controls.
The group operates using a two-cell model: a social engineering team for initial access and a technical team for data theft. After establishing access via RMM, technical operators perform reconnaissance and use tools like Rclone to stage and exfiltrate sensitive data to cloud storage providers like MEGA or Dropbox. The group then monetizes this data through extortion, threatening public leaks unless a ransom is paid.
This threat is particularly dangerous because it leaves a minimal forensic footprint. There are no malicious payloads to signature or exploits to patch. Organizations in the legal, financial, and professional services sectors are primary targets. Defense requires a shift from payload-centric detection to behavioral monitoring of RMM tools and outbound data transfers.