How Luna Moth Hackers Use Fake IT Help Desks to Target US Companies (2025 Update)

The Luna Moth cybercrime group – also known as Silent Ransom Group – is ramping up attacks on US legal and financial firms by leveraging sophisticated IT help desk impersonation scams. Unlike typical ransomware attacks, these hackers use callback phishing and remote monitoring and management (RMM) tools to infiltrate networks, steal sensitive data, and later demand ransoms ranging from one to eight million USD. In this comprehensive guide, we break down their methods, highlight key indicators of compromise (IoCs) from EclecticIQ, and outline essential mitigation strategies.

Who Are the Luna Moth Hackers?

Emerging initially as a splinter group from the notorious Conti-affiliated BazarCall campaigns, Luna Moth has evolved into a sophisticated extortion outfit. Their tactics have shifted from deploying ransomware to relying solely on social engineering techniques. According to EclecticIQ, as detailed in their latest report, these attackers have registered over 37 typosquatted domains specifically mimicking IT help desks.

Key Characteristics of Luna Moth Attacks:

• BazarCall Legacy: Initially used for initial network penetration, as reported by BleettingComputer.
• Ransomware Rebranding: Following the Conti shutdown in March 2022, these operators rebranded into the Silent Ransom Group. More details can be found here.
• Callback Phishing Strategy: Instead of sending direct malware or malicious attachments, they convince victims to install legitimate-looking RMM tools.
• Targeted Sectors: Focus on US legal and financial sectors where large volumes of sensitive data are stored.

How Does the Callback Phishing Attack Work?

The attack workflow typically follows a series of well-orchestrated steps which confuse even the vigilant IT staff:

1. Phishing Emails and Fake Calls: Victims receive emails that appear to originate from their internal IT support. These messages instruct them to call a help desk number which, unbeknownst to them, connects directly to a Luna Moth operator.
2. RMM Tool Installation: During the call, the attacker impersonates an IT specialist and guides the victim through installing a remote monitoring and management tool. Tools such as AnyDesk, Zoho Assist, Syncro, and SuperOps are among those exploited because their digitally signed status does not trigger traditional security alerts.
3. Data Exfiltration: Once access is granted, the attacker navigates the network, identifies sensitive data, and uses tools like WinSCP (via SFTP) or Rclone to transfer files to an attacker-controlled server.

Understanding the Security Gaps: RMM Tools and Social Engineering

One of the most concerning aspects of Luna Moth’s approach is their reliance on legitimate, digitally signed software. As these RMM tools are standard in IT operations, they naturally bypass common cybersecurity defenses. The attackers exploit this trust, blending their malicious activities with legitimate network processes.

Why This Method is Particularly Dangerous:

• Legitimacy: Since tools such as Syncro, SuperOps, or AnyDesk are signed and widely used, their usage in these scams rarely raises red flags.
• Social Engineering Prowess: By impersonating internal help desk teams, the hackers manipulate even experienced IT administrators into believing the requests are genuine.
• Subtle Execution: The absence of malware files or suspicious attachments means traditional antivirus solutions may not detect the breach until it’s too late.

Mitigation Strategies and Best Practices

To safeguard your organization from such deceptive attacks, cybersecurity professionals and IT administrators should consider the following steps:

• Block IoCs: Keep a regularly updated blocklist of IoCs provided by EclecticIQ, including suspicious domains and IP addresses.
• Restrict RMM Tool Usage: Limit and log the usage of remote monitoring and management tools to only pre-approved vendors within your organization.
• Employee Training: Conduct regular training sessions on identifying social engineering attacks and the risks of unsolicited IT support calls.
• Implement Zero-Trust Policies: Adopt a zero-trust security model where every access request must be verified, especially when remote tools are involved.

For further insight into advanced mitigation techniques, refer to our internal guide on MITRE ATT&CK defense strategies and learn how to align your security posture with industry best practices.

Conclusion: Staying Ahead of the Threat

The evolution of Luna Moth hackers from traditional ransomware crews to experts in social engineering and RMM tool exploitation highlights a critical need for vigilance within the cybersecurity community. US-based organizations, particularly those in legal and financial sectors, must remain alert and proactively adjust their security strategies to counter these emerging threats.

Remember, a robust defense begins with awareness. Download The Red Report 2025 to explore the top 10 MITRE ATT&CK techniques driving 93% of today’s cyber attacks and fortify your defenses against evolving threats.

Stay updated, stay secure, and be vigilant against sophisticated social engineering scams.

For additional resources, check out detailed coverage of the callback phishing trends and thorough analyses of past BazarCall campaigns on BleepingComputer.