Unlike many cybercriminal groups that deploy malware or exploit system vulnerabilities, Luna Moth relies almost entirely on social engineering. They craft convincing phishing emails or place phone calls designed to manipulate employees into handing over access willingly.

Their classic scam starts with a phishing email masquerading as a subscription service notification—think small charges for software renewals. These modest sums are less likely to trigger immediate alarm.

Victims are directed to call a provided number to cancel the subscription. On the other end, SRG actors posing as customer support agents guide them to download remote access software like AnyDesk, Zoho Assist, or Splashtop. Once access is granted, the criminals quietly slip into the system.

Starting in March 2025, Luna Moth began escalating tactics by calling employees directly, pretending to be from the company's IT department. They instruct the unsuspecting employee to join a remote access session or visit a fake company webpage. Under the pretense of “overnight maintenance,” the attackers gain persistent access without raising suspicion.

Once inside, they waste no time. Rather than seeking administrative privileges or deploying ransomware, they pivot straight to data exfiltration, using tools like WinSCP (Windows Secure Copy) or stealthy, renamed versions of Rclone. Even when administrative access is limited, portable versions of WinSCP allow data extraction.

What sets Luna Moth apart from traditional ransomware gangs is their no-malware approach. There’s no encryption, no locked systems—just pure extortion. Once data is stolen, the victim receives ransom emails threatening to release or sell the information unless payment is made.

In some cases, SRG actors apply direct pressure by calling employees, trying to force them into engaging in ransom negotiations. They’ve even set up a public-facing site to post stolen victim data—although, notably, they don’t always follow through on their threats to publish.

This shift toward extortion-only operations marks a broader evolution in cybercrime. Without the telltale signatures of malware, these attacks leave few traces on infected machines, making them difficult to detect with traditional antivirus tools.

Despite the stealth, the FBI warns defenders to watch for specific red flags that may signal Luna Moth activity:

• New, unauthorized downloads of system management or remote access tools.

• Outbound connections from WinSCP or Rclone to external IP addresses.

• Emails or voicemails claiming stolen data, often from unnamed groups.

• Phishing emails offering subscription cancellations, urging a callback.

• Unsolicited phone calls pretending to be from internal IT staff.

These subtle clues are critical for early detection, especially since Luna Moth’s tactics focus on blending into normal operations.

While SRG has historically targeted multiple industries, law firms have become a favoured target. Legal data includes sensitive contracts, privileged communications, intellectual property, and evidence—an attractive trove for extortionists.

The legal sector’s reliance on confidentiality and reputation amplifies the stakes. A data breach doesn’t just threaten operational disruption or financial penalties; it risks undermining client trust and the very foundation of the firm’s business model.

Luna Moth’s rise reflects a wider trend: the evolution away from malware-heavy ransomware toward human-centered attacks. By leveraging social engineering, SRG bypasses hardened technical defenses, targeting the softest point in any cybersecurity setup—people.

It’s a reminder that while organizations invest in robust security tools, no software can replace vigilant, well-trained staff who can spot phishing, suspicious calls, and social engineering tactics.

Luna Moth, or Silent Ransom Group, has shown that the most damaging cyberattacks don’t always need advanced malware or sophisticated exploits. Sometimes, all it takes is a convincing voice on the other end of the line.

As law firms and other high-value targets come under siege from these extortion campaigns, the lesson is clear: in the evolving world of cybercrime, the human element is both the greatest vulnerability and the most critical line of defense. Organizations that strengthen their awareness, tighten their protocols, and build a culture of security vigilance will be best positioned to fend off the rising tide of silent extortion.