Luna Moth
Also known as Silent Ransom, TG2729, SilentRansomGroup
Luna Moth conducts high-tempo callback phishing campaigns targeting legal and financial organizations in the U.S., using social engineering to lure victims into calling fake helpdesk numbers. Attackers impersonate IT staff to install legitimate RMM tools, enabling direct access to victim systems for data exfiltration. The group demands ransoms between $1 million and $8 million, threatening to leak stolen data if payments are not made. Their operations reflect a shift from traditional ransomware tactics to data breach extortion, leveraging trusted systems to evade detection.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- 🚨New ransom group blog post!🚨 Group name: SilentRansomGroup Post title: W... B... Info: https:// cti.fyi/#disclosure/SilentRans omGroup/W...%20B ... # ransomwmastodon · Nov 4, 2026
- 🚨New ransom group blog posts!🚨 Group name: incransom Post title: chicagolawyer.com Organization: Staver Accident Injury Lawyers Location: 🇺🇸 US Sector: Legamastodon · Oct 30, 2026
- 🚨New ransom group blog posts!🚨 Group name: genesis Post title: Fred H Beck Associates Location: 🇺🇸 US Sector: Real Estate Info: https:// cti.fyi/#disclosuremastodon · Oct 30, 2026
- 🚨New ransom group blog posts!🚨 Group name: Global Secret Group Post title: TDS Telecommunications LLC. Organization: TDS Telecommunications LLC Location: 🇺🇸mastodon · Oct 29, 2026
- 🚨New ransom group blog post!🚨 Group name: SilentRansomGroup Post title: Lowenstein Sandler LLP Location: 🇺🇸 US Sector: Legal Info: https:// cti.fyi/#disclosmastodon · Oct 28, 2026
- 🚨New ransom group blog post!🚨 Group name: SilentRansomGroup Post title: L... Info: https:// cti.fyi/#disclosure/SilentRans omGroup/L ... # ransomware # cti # mastodon · Oct 28, 2026
- 🚨New ransom group blog posts!🚨 Group name: genesis Post title: A B Lab Sector: Professional Services Info: https:// cti.fyi/#disclosure/genesis/A% 26B%20Lab Gmastodon · Oct 28, 2026
- 🚨New ransom group blog posts!🚨 Group name: dragonforce Post title: Zhito Technology Location: 🇨🇳 CN Sector: Technology Info: https:// cti.fyi/#disclosure/drmastodon · Oct 27, 2026
References
- https://blog.eclecticiq.com/from-callback-phishing-to-extortion-luna-moth-abuse-reamaze-helpdesk-and-rmm-tools-against-u.s.-legal-and-financial-sectors
- https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/
- https://www.ransomlook.io/group/silent%20ransom
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.