Leaked documents tied to the Luna Moth extortion group are giving defenders a rare look at how the operation is organized. According to Infosecurity Magazine, the material suggests a multi-pronged effort in which social engineering specialists and more technical attackers work together to manipulate a single target. For anyone trying to understand the Luna Moth social engineering playbook, that division of labor is the key detail, because it explains why a single convincing phone call can lead to a much larger intrusion.

What the Luna Moth social engineering playbook leaks reveal

The group is also known as the Silent Ransom Group, Chatty Spider and UNC3753. Public advisories, including one referenced in search results from the FBI and the IC3, describe it as targeting law firms with social engineering techniques, including impersonating IT personnel. Separate threat research describes the use of callback phishing as part of its data extortion campaigns.

What the new leaks add, based on the reporting, is a view from the inside. Rather than a lone attacker doing everything, the documents point to a coordinated effort aimed at one victim at a time. Earlier coverage on vpn.social looked at how the Luna Moth files expose a law firm extortion playbook and at alleged payments surfaced by a separate leak. Together, these leaks suggest a structured business rather than a loose collection of opportunists.

It is worth being careful here. The source article is a short summary, and the leaked documents themselves are claims that have not all been independently verified. The pattern they describe, however, matches what public advisories have already warned about.

How callers and technical intruders split the work

The practical lesson from the reported structure is that the attack is a relay. One group of people handles the human side: building a believable pretext, getting a target to engage, and persuading them to take a specific action. Another group handles the technical side: using whatever access that conversation produces to move through systems and take data.

That split matters for two reasons.

First, the person on the phone does not need to be technically sophisticated. Their job is persuasion. They only need the target to hand over a credential, approve a prompt, or open a door, and the technical operators take it from there.

Second, the technical operators do not need to find a software flaw. If a legitimate login or a trusted remote session is handed to them, much of their work looks like normal activity. This is why attacks of this kind are hard to catch with perimeter tools alone.

The consequences have been visible in the legal sector. Reporting we covered earlier noted that Jones Day and Mayer Brown confirmed sensitive files were stolen, and in at least one case published online after extortion demands went unpaid. A related report on rising law firm attacks and vishing scams shows the same theme: the entry point is often a person, not a piece of malware.

Spotting phishing and vishing pretexts before you act

Because the first stage is a conversation, your best early defense is a habit rather than a tool. Pretexts that impersonate IT support tend to share a few traits:

  • Urgency. The caller or email says something is broken, expiring or compromised and needs action right now.
  • Unsolicited contact. You did not open a ticket, yet someone claims to be helping with one.
  • A request for access. You are asked to read out a code, approve a login prompt, install software or start a remote session.
  • A callback number supplied by the sender. Callback phishing relies on you dialing a number that the attacker controls.

The response is simple, if awkward in the moment. Hang up or stop replying. Then contact your IT team or provider using a number or channel you already know is genuine, such as an internal directory or the official company website. Do not use contact details from the message itself. Legitimate support staff will not mind being verified.

Small organizations should also agree on a rule in advance: no one is ever asked to approve a login or install remote-access software because of an inbound call. A written rule takes the pressure off the individual employee.

Limiting the damage after a credential is stolen

Assume that eventually someone will be fooled. The goal then is to make a stolen credential less useful.

Use phishing-resistant MFA. Codes sent by text message or app prompts can be talked out of a victim on a call. Hardware security keys and passkeys are designed to work only with the genuine site, which removes the most common thing a caller can ask for.

Limit what any one account can reach. If a single login can open every file share, a single call can expose everything. Separate access by role and remove old permissions.

Watch for unusual remote tools and large transfers. New remote-access software or bulk data movement outside normal hours should trigger a review.

Have a response plan. Know who to call, how to disable accounts quickly, and how to preserve evidence. Extortion groups rely on confusion and delay.

What This Means For You

You do not need to be a law firm to be a target for this style of attack. The same pretexts work on any employee or individual who has access worth stealing. The leaks reinforce that the weakest point is often the moment someone decides whether to trust a voice. If you work with sensitive client or customer data, the structure described in the leaks should shape your priorities: verify first, protect accounts with stronger authentication, and reduce what any single account can reach.

Actionable takeaways

  • Treat any unexpected call from "IT support" as unverified until you confirm it through a known channel.
  • Never read out codes, approve prompts or install remote tools at the request of an inbound caller.
  • Move critical accounts to phishing-resistant MFA such as security keys or passkeys.
  • Trim account permissions so one stolen login cannot expose everything.
  • Write down a verification rule and an incident contact list before you need them.

The Luna Moth social engineering playbook works because it combines a convincing human voice with patient technical follow-through. Review your own exposure to fake IT-support calls this week, switch to phishing-resistant MFA where you can, and read our related coverage of the Luna Moth leaks and vishing-driven extortion to see how these attacks unfold in practice.