Leaked Files Reveal How Luna Moth Ransomware Group Runs Like a Business

Leaked files have given a rare look inside the Luna Moth ransomware group, also known as Silent Ransom Group and tracked as Chatty Spider UNC3753. The documents appeared on an anonymous onion site called "The Luna Moth Files" in early October 2026 and claim to contain internal files and chat logs. Check Point researchers published their analysis on October 9, describing a multi-layered, businesslike operation with staff working on different stages of an attack designed to steal confidential data and extort payment through blackmail.

The operation starts with planning, where operators pick organisations and individuals to target and gather enough business context to make the first contact look entirely legitimate. The victim is then persuaded to talk by phone. In many cases the attacker poses as IT support or IT security staff and convinces the target to give remote access to their computer using a remote access software tool. That access can give the attacker a foothold in the network, which can then be used to move around and escalate privileges.

According to the leaked documents, callers are given scripts that anticipate common victim responses, including advice on handling people who are distrustful or resistant. The files also appear to show that the caller is not acting alone during these calls, and that work is divided between a social engineer and a hands-on keyboard attacker. This is only the opening of the reported findings, so further detail may exist in the full research.