Loading threat actor…
Luna Moth, also known as Silent Ransom Group, Silent Ransom, SRG, UNC3753, Storm-0252, and Chatty Spider, is a financially motivated cyber extortion actor focused heavily on social engineering and data-theft-led extortion rather than traditional malware-driven encryption. The group has been described as a Russian cyber extortion operation and has been linked by some reporting to former Conti members or a broader post-Conti criminal ecosystem. The actor is best known for targeted campaigns against U.S. law firms and other professional-services organizations. Reported victimology also includes insurance-related targets. Its operations commonly begin with callback phishing or voice phishing in which operators impersonate internal IT staff, help desks, or service providers and use pretexts such as subscription renewals, invoices, or data migration. Victims are persuaded to initiate screen-sharing sessions or install legitimate remote monitoring and management tools, including commercial remote-access software, to grant the attackers hands-on access. After obtaining access, Luna Moth conducts interactive post-compromise activity oriented toward identifying and stealing sensitive business data, including legal agreements, personally identifiable information, and financial records. Reported tooling and tradecraft include use of legitimate remote-access platforms, network-share discovery, network scanning, file staging, and exfiltration utilities. The group has been associated with data exfiltration followed by extortion demands threatening public exposure of stolen information, making it a prominent example of encryption-less extortion. A notable evolution in tradecraft is the use of in-person social engineering. Operators have reportedly sent individuals to victim offices while posing as IT technicians or support personnel, seeking direct workstation access and using removable media to copy data. Separate reporting also indicates recruitment of local gig workers to approach victims under false help-desk-related pretenses. This blend of remote deception and physical-world intrusion distinguishes the group from many ransomware actors. Luna Moth has been repeatedly associated with attacks on prominent law firms in the United States, reinforcing a narrow but deliberate sector focus on organizations holding highly sensitive client and case data. The actor’s dominant objective is financial gain through extortion based on stolen information rather than destructive or espionage-driven outcomes.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
388 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack resulting in a data breach against Reminger Attorneys at Law.
Conducting a ransomware attack against Riker Danzig Scherer Hyland & Perretti, a US law firm in the professional services sector.
Conducting a ransomware attack against Riker Danzig LLP.
Conducting a ransomware attack against a U.S.-based organization.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.