Skip to navigation

Threat reportRansomwareTL-2026-2176

Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusion

highACTIVE

Silent Ransom Group (SRG), aka Luna Moth and Chatty Spider, is running an active callback-phishing and vishing campaign against US law firms, impersonating IT helpdesk staff by phone and email to obtain remote access via legitimate RMM tools, then escalating to physical on-site intrusion when remote tactics fail.

Key facts for Luna Moth physical intrusion extortion

IdentifiersTL-2026-2176
SeverityHIGH
Exploitation statusExploited in the wild
AttributionSilent Ransom Group (high confidence)
MalwareAnyDesk
ToolsAnyDesk, Atera, Microsoft Quick Assist, Quick Assist, Rclone - S1040, Reamaze Helpdesk, RustDesk, Splashtop, SuperOps, Syncro, WinSCP
MITRE ATT&CK techniquesT1005 Data from Local System, T1036.005 Match Legitimate Resource Name or Location, T1039 Data from Network Shared Drive, T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB, T1204.001 User Execution: Malicious Link, T1219 Remote Access Tools, T1566.001 Phishing: Spearphishing Attachment, T1566.004 Phishing: Spearphishing Voice, T1567.002 Exfiltration to Cloud Storage, T1583.001 Acquire Infrastructure: Domains, T1588.002 Obtain Capabilities: Tool and 5 more in the attack flow
MotivationFINANCIAL
Target sectorslegal, law-firms, insurance, finance, accounting, health
Target regionsunited states of america
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for Luna Moth physical intrusion extortion

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2176 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Silent Ransom Group — Typosquatted Helpdesk Domain Contact Following Invoice Lure Click

Detects a workstation resolving or connecting to a domain matching the SRG/Luna Moth typosquatted-helpdesk registration pattern ([company]-helpdesk[.]com, e.g. vorys-helpdesk.com, registered via GoDaddy/domaincontrol.com nameservers) shortly after the same user received or opened a subscription/invoice-themed email — the callback-phishing (TOAD) lure that funnels victims into a fraudulent IT support call.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1591, T1566.004, T1583.001, T1036.005
  • Data sources: zscaler_proxy, cisco_umbrella_dns, o365_management_activity, proofpoint_email
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy (sourcetype=zscaler OR sourcetype=bluecoat OR sourcetype=cisco:umbrella OR sourcetype=palo:traffic)
| rex field=dest_host "(?<lure_domain>[a-z0-9\-]+\-helpdesk\.(com|net|org))"
| where isnotnull(lure_domain) OR match(dest_host, "(?i)business\-data\-leaks\.com") OR match(dns_answer, "(?i)domaincontrol\.com")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as contacted_domains values(dns_answer) as ns_records by src_ip, user
| join type=left user
    [ search index=email (sourcetype="o365:management:activity" OR sourcetype="proofpoint:email") subject="*invoice*" OR subject="*subscription*" OR subject="*charge*"
      | stats count as invoice_email_count min(_time) as email_time by user ]
| where count>0
| sort -first_seen

Microsoft KQL

let LureDomains = dynamic(["business-data-leaks.com"]);
EmailEvents
| where Timestamp > ago(24h)
| where Subject has_any ("invoice", "subscription", "pending charge")
| project SenderFromAddress, RecipientEmailAddress, Subject, EmailTime = Timestamp
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl matches regex @"[a-z0-9\-]+-helpdesk\.(com|net|org)" or RemoteUrl has "business-data-leaks.com"
    | project DeviceName, AccountName, RemoteUrl, ConnectTime = Timestamp
) on $left.RecipientEmailAddress == $right.AccountName
| where ConnectTime - EmailTime between (0min .. 240min)
| project DeviceName, AccountName, Subject, RemoteUrl, EmailTime, ConnectTime
| order by ConnectTime desc

Sigma

title: Silent Ransom Group Typosquatted Helpdesk Domain Contact
id: 6f2e3a10-9c41-4b1a-9d3e-7a1c2f5b8e01
status: experimental
description: Detects DNS resolution or proxy connection to a typosquatted [company]-helpdesk[.]com domain consistent with Silent Ransom Group / Luna Moth callback-phishing (TOAD) infrastructure
references:
    - https://www.ic3.gov/CSA/2026/260526.pdf
    - https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.reconnaissance
    - attack.t1591
    - attack.initial-access
    - attack.t1566.004
    - attack.t1583.001
    - actor.silent_ransom_group
    - actor.luna_moth
logsource:
    category: dns_query
    product: windows
detection:
    selection_lure:
        QueryName|re: '[a-z0-9\-]+\-helpdesk\.(com|net|org)$'
    selection_leaksite:
        QueryName|contains: 'business-data-leaks.com'
    condition: 1 of selection_*
falsepositives:
    - Legitimate internal helpdesk subdomains that happen to match the naming pattern (verify against organizational domain allowlist)
level: high

Known false positives:

  • Legitimate company-run helpdesk subdomains that coincidentally match the -helpdesk naming convention

Tuning notes: Maintain an allowlist of verified internal helpdesk/ticketing domains and exclude them from the lure_domain match; extend the regex list as new EclecticIQ/FBI-reported typosquat domains are disclosed.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Silent Ransom Group — Invoice-Themed Vishing Lure Email with Callback Phone Number · unlock with TL Creds
  • Silent Ransom Group — Physical Intrusion USB Insertion Following RMM Session on Sensitive-Department Workstation · unlock with TL Creds
  • Silent Ransom Group — Syncro Persistence Agent Installed Outside Change Window · unlock with TL Creds
  • Silent Ransom Group — Impersonation of Legitimate Helpdesk Platform (Reamaze) During Support Session · unlock with TL Creds
  • Silent Ransom Group — Local and Network Share Enumeration Preceding Bulk File Access · unlock with TL Creds
  • Silent Ransom Group — Extortion Communication Referencing Leak Site or Large BTC/USD Demand · unlock with TL Creds
  • Silent Ransom Group — Unauthorized RMM Tool Installation on Endpoint · unlock with TL Creds
  • Silent Ransom Group — WinSCP/Rclone Bulk Exfiltration to Cloud Storage · unlock with TL Creds

Indicators of compromise for Luna Moth physical intrusion extortion

As of 2026-08-28, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2176.

Sample indicators (2 of 24)

  • Domain: business-data-leaks[.]com
  • Domain: vorys-helpdesk[.]com

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

24 indicators of compromise · unlock with TL Creds. Compare plans

How Luna Moth physical intrusion extortion works

The group exfiltrates sensitive data (no encryption) and extorts victims for multi-million-dollar payments, including a disclosed $20 million demand in May 2026.

Silent Ransom Group is a financially motivated data-extortion actor that split from the Conti ransomware syndicate in March 2022 and grew out of the earlier BazarCall/BazarBackdoor callback-phishing operation. Rather than deploying ransomware encryptors, SRG steals sensitive files and threatens public disclosure unless paid. Since Spring 2023 the group has consistently targeted US-based law firms, with secondary targeting of insurance, finance, healthcare, and accounting organizations, prizing the high extortion leverage of privileged legal and client data.

The group's initial access relies on telephone-oriented attack delivery (TOAD): phishing emails disguised as subscription or online-class invoices instruct the recipient to call a helpdesk number to dispute a pending charge, or attackers cold-call employees directly claiming to be internal IT staff. Both paths funnel the victim into a live phone conversation where the actor talks them into joining a remote-support session and installing a legitimate remote monitoring and management (RMM) tool — observed tools include Zoho Assist, Syncro, SuperOps, Atera, AnyDesk, Splashtop, RustDesk, and Microsoft Quick Assist. Because these are digitally signed, widely used administration tools, the technique evades both signature-based and behavioral detection and leaves few forensic artifacts.

EclecticIQ assessed with high confidence (March 2025) that SRG had registered at least 37 typosquatted helpdesk domains through GoDaddy (patterns such as "[company]-helpdesk[.]com") to support the callback lures. Around March 2025 the group's tradecraft shifted further toward direct, unsolicited vishing calls rather than waiting for victims to dial in, and beginning in Spring 2025/2026 SRG began sending an operative to physically visit a target's office posing as IT/support staff, where they insert USB storage devices or external drives directly into workstations to image data when remote access is blocked or insufficient — a tactic the FBI's May 2026 Flash Report (FLASH-20260526-01) confirmed as an active, escalating technique.

Once access is established, SRG performs minimal privilege escalation and searches local files and network shares for sensitive material (client files, case notes, financial records, regulatory correspondence), then exfiltrates it using WinSCP (including a portable, non-admin variant) over SFTP, or Rclone — sometimes hidden or renamed to evade detection — to cloud storage such as MEGA, Google Drive, and Microsoft OneDrive. Persistence, where obtained, has used Syncro. Following exfiltration, SRG sends extortion emails and places direct phone calls to employees and even clients to apply pressure, demanding payment (historically 2-78 BTC, and $1-8 million USD in FBI-reported cases, with a $20 million payment from an unnamed US law firm disclosed in May 2026) and threatening to publish data on its clearweb leak site (business-data-leaks[.]com per the FBI Flash Report).

The FBI and IC3 have issued at least two public advisories (May 2025 and May 26, 2026) as reported intrusion activity accelerated, with Mandiant documenting a concentrated wave of law-firm breaches between January and May 2026.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1039 Data from Network Shared Drive

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation

Exfiltration

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol; T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB; T1567.002 Exfiltration to Cloud Storage

Execution

T1204.001 User Execution: Malicious Link

Command and Control

T1219 Remote Access Tools

Initial Access

T1566.001 Phishing: Spearphishing Attachment; T1566.004 Phishing: Spearphishing Voice

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1589.002 Gather Victim Identity Information: Email Addresses; T1591 Gather Victim Org Information; T1598.004 Phishing for Information: Spearphishing Voice

Impact

T1657 Financial Theft

Remediation for Luna Moth physical intrusion extortion

Immediate actions

  • Implement mandatory callback-verification protocols before any employee installs remote-access/RMM software, using an internal directory number rather than a number provided in an email or by the caller
  • Block outbound access to known unauthorized RMM installer domains and binaries not on an organizational allowlist
  • Alert front-desk, reception, and physical-security staff to verify identity and IT-ticket numbers before granting building or workstation access to any 'IT support' visitor
  • Monitor for and restrict USB/removable-media mounting on workstations in sensitive departments (legal, finance)

Workarounds

  • Restrict local admin rights so unauthorized RMM tools cannot install with elevated privileges, forcing attackers into detectable portable/non-admin tool use
  • Require identity verification (photo ID plus IT ticket confirmation) for any in-person device service visit

Longer-term hardening

  • Deploy application allowlisting to restrict execution of RMM tools to an approved, IT-managed set (Zoho Assist, Syncro, SuperOps, Atera, AnyDesk, Splashtop, RustDesk, Quick Assist all observed abused)
  • Deploy DLP and egress monitoring for WinSCP/SFTP and Rclone traffic to cloud storage providers (MEGA, Google Drive, OneDrive)
  • Run recurring vishing/callback-phishing awareness training specifically modeled on TOAD (telephone-oriented attack delivery) scenarios
  • Establish an incident response playbook for extortion-only (non-encryption) intrusions, including legal/PR coordination given SRG's practice of contacting employees and clients directly

Timeline of Luna Moth physical intrusion extortion

  • locked-ioc-3 (locked-ioc-14) splits from the Conti ransomware syndicate as Conti collapses, pivoting from BazarCall/BazarBackdoor callback operations to standalone data-extortion attacks.
  • SRG shifts primary targeting focus to US-based law firms, exploiting the high extortion leverage of privileged legal and client data.
  • SRG tradecraft shifts toward direct, unsolicited vishing calls impersonating internal IT staff rather than waiting for victims to call back.
  • EclecticIQ assesses with high confidence that locked-ioc-14 has registered at least 37 typosquatted helpdesk domains via locked-ioc-17 to support callback-phishing lures.
  • Security media (BleepingComputer, The Hacker News, IT Pro) report on locked-ioc-14's callback-phishing campaign against law firms and its EclecticIQ-documented domain infrastructure.
  • FBI and IC3 issue their first public cyber alert on locked-ioc-3 targeting US law firms.
  • Initial reconnaissance and targeting activity for a new wave of SRG intrusions is observed in early April 2026.
  • First confirmed intrusions of the 2026 wave are reported in late April 2026, including escalation to physical on-site intrusion (operatives posing as IT staff inserting USB/storage devices).
  • An unnamed US law firm pays a reported $20 million ransom to locked-ioc-3, the largest disclosed single payment in the campaign.
  • FBI issues Flash Report FLASH-20260526-01 (TLP:CLEAR), confirming physical intrusion as an active SRG tactic and naming the group's clearweb leak site locked-ioc-1.
  • S-RM publishes its Cyber Intelligence Briefing covering the ongoing locked-ioc-3 campaign against US law firms, the source of this threat record.

Sources cited for Luna Moth physical intrusion extortion

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats