Cyber criminals: Detailed process
A group of cyber criminals that specialises in attacks on law firms is taking a “commercial-style approach” to managing their victims, with “a structured sequence of negotiation and monetisation stages” a report has found.
Researchers said that “rather than treating each extortion case as an isolated operation”, labels are used to divide discussions into ‘chat’, ‘offer’, ‘contract’ and ‘gold’.
Cyber-security firm Check Point based its report on what is believed to be a major leak earlier this month of material from the Silent Ransom Group (SRG), also known as Chatty Spider and Luna Moth. The leaked material has been referred to as the ‘Luna Moth Files’.
It said the SRG’s model “generally does not depend on encrypting victim systems”; rather, it relies on “social engineering” to obtain access, steal sensitive information, and pressure organisations into paying up.
The FBI published an alert in May, warning that the SRG was “actively targeting law firms using social engineering and impersonation techniques”.
The report, Inside the Luna Moth Files: Reconstructing Silent Ransom Group’s Operating Model [1], said the SRG made “repeated references to the legal sector and an ambition to target the top 100 law firms globally”.
The group is known to have extorted large sums of money from top US-based law firms, and researchers said 42 of its 50 most recently observed victims were law firms.
The leaked material, which is unverified and in some parts inconsistent, showed that the SRG was “organised like a service company, with different people handling each stage of an attack”.
The SRG used workers to “build credible business personas”, callers to impersonate internal IT, a second operator to work on the victim’s machine during the call, and negotiators to handle payment.
Callers are urged to stay on a live group chat throughout the session and report any change in the victim’s behaviour “so the conversation stays calm while data is taken”.
Researchers said the use of internal specialisation and real-time collaboration by SRG made its operation “closer to a co-ordinated service business than an improvised fraud call”.
The SRG’s model started with detailed organisational research, so its callers were not approaching a random employee. The operation “appears to identify high-value organisations, profile relevant personnel, and construct an identity that can survive basic scrutiny”.
The group’s disclosed script described “a deliberate sequence of anxiety, reassurance, and renewed urgency”.
Researchers said: “The caller is instructed to present confidently as internal IT, report suspicious activity, reassure the employee that a malicious message was blocked, and then restore urgency by claiming that other employees compromised the network.
“Remote access is framed as a protective security check rather than an attacker’s request.
“The caller is also told to understand the remote-access application thoroughly, keep the victim calm, monitor the operator chat continuously, and finish with a benign explanation for the activity on the device.
“The script therefore functions as a behavioral playbook, not merely a list of lines to read.”
Check Point said SRG appeared to experimenting with “more durable human access”, and had started a ‘fake employee’ project.
“These materials are consistent with the FBI’s independent reporting that SRG has attempted physical access by sending individuals posing as IT personnel to victim locations.”
It added: “If authentic, the exposure shows that Luna Moth should be understood less as a conventional ransomware crew and more as a specialised data-extortion business whose core platform is the co-ordinated manipulation of trust.”