Luna Moth leak: no new malware, a phone call and a remote tool, and Check Point treats the files as unverified

Check Point calls the Luna Moth Files unverified and finds no new malware in them

Check Point's own report says the archive known as the Luna Moth Files should be treated as "an unverified primary-source disclosure rather than fact", and its blog post says "The material contains no new exploit and no new malware." The same report gives one checkable count of whom the group has been attacking: of its 50 most recently observed victims, 42 were law firms, which is 84 per cent (derived). If the files are genuine, they show how a group that Check Point says "generally skips encryption" divides the work of a single phone call: one person keeps an employee calm while, Check Point infers, a second person works the employee's computer through a remote session.

That fact does not establish the thing most coverage assumes. Nobody has shown that the files are authentic: Check Point opens its conclusion with "If authentic", writes that "Nobody knows who published it or how the archive was obtained", and notes that the site's two message totals disagree and its headline financial figure does not reconcile with its own table. It does not establish how large or successful the group is, what share of victims paid, how many victims there are, which sectors beyond a sample, whether the leaked material describes current practice or older practice, or whether the leak came from an insider, a rival or law enforcement. No source read says which, and this briefing does not guess.

This briefing reads Check Point's blog post (its page data show publication on 9 October 2026 and a last modification on 11 October) and the 14-page report it links, "Inside the Luna Moth Files", which opened without a form. It also reads the FBI's two products on the group (23 May 2025 and 26 May 2026), Mandiant's report of 5 June 2026 and Unit 42's of 21 November 2022. Infosecurity Magazine's report of 12 October and Reuters' report of 7 October are secondary and are used as pointers and for what Chainalysis told Reuters. Sources were read from 20:22 BST on Monday 12 October 2026. No leaked file was opened, and the leak site, an anonymous onion site, was not visited, linked or described. This briefing prints no individual, no victim, no indicator, no tool command and no wording a caller would use.

Check Point, Mandiant (Google), Unit 42 (Palo Alto Networks) and Chainalysis all sell security or investigation products, and Check Point's report ends with a page about its own exposure management service, so every finding below is attributed to its seller.

Stated and not stated: what the record fixes and what it leaves open

"Not stated" means not found in the pages read, in full. It does not mean the information does not exist. Check Point's report is the main source for the first column, and where another source supplies a figure it is named.

What Check Point's blog post (9 October 2026) and report (October 2026) state about the Luna Moth Files, and what they do not. Other sources are named where they supply a figure.

The question	Stated	Not stated
Are the files genuine?	Check Point: "an unverified primary-source disclosure rather than fact". The conclusion opens "If authentic". The site shows two different message totals and a headline financial figure that does not reconcile with its own table.	Any test of authenticity by Check Point, or the chain of custody. Reuters says it could not immediately verify the site's claims or data.
Who published it, and why?	"Nobody knows who published it or how the archive was obtained."	Whether the source was an insider, a rival or law enforcement. No source read says, and this briefing does not guess.
How big is the archive?	The site claims "thousands of messages from two chat servers, dozens of attachments, and Bitcoin wallets" (Check Point, describing the site's claims).	The real message count, the number of documents, the months covered, how many operators appear.
How is the work divided?	Four roles: target researchers and persona builders, callers, technical participants, and negotiators and payment handlers (derived count: 4). The vishing document tells the caller to monitor a separate group chat.	A formal hierarchy (the archive "does not establish" one), headcount per role, and that a second operator really used the session: Check Point says the document "implies" it.
Who are the victims?	42 of the 50 most recently observed victims were law firms. Across a broader dataset: Business Services 69, Finance 22 and Real Estate 2 classifications.	The window behind "most recently", whether the leak names victims (this briefing prints none), the total, or any UK count.
What was paid?	Check Point states no payment figure and says claims about "confirmed payments" need independent corroboration. Reuters reports Chainalysis saying leaked addresses sit downstream of "millions of dollars" in payments. Unit 42 recorded 2022 demands of 2 to 78 BTC.	The share of victims who paid, a typical 2026 demand, or any payment figure Check Point vouches for.
How fast is the operation?	Check Point gives no time. Mandiant (June 2026): in many incidents the whole sequence "occurred within a single business day", and data searches and theft began "in under an hour".	A time taken from the leaked material, or from any UK incident.
Does it encrypt anything?	Check Point: "generally skips encryption". The FBI (26 May 2026): "without relying on traditional ransomware encryption". Mandiant: a LockBit variant was deployed in 2022, with data-theft extortion only since.	Whether any 2026 incident encrypted anything. Mandiant's technique table still lists data encrypted for impact, with no explanation.
Is it current?	Check Point's workflow mixes behaviour documented by the FBI, Mandiant and Unit 42 with detail "alleged by the October 2026 exposure".	When the chats were written, or whether any script has changed since.
Beyond the phone?	The chats discuss recruitment and a project named "Fake_Employee". The FBI separately reports people posing as IT staff attending offices in person.	Any successful placement of a fake employee. Check Point calls that evidence "weaker".
Which remote tool?	Check Point names none. Its report says the caller is told to understand the remote-access application thoroughly. The FBI's 2026 product lists seven named products to watch for.	Which product the leaked script teaches.

Two rows deserve a second look. On authenticity, the only outside corroboration of any kind comes from Chainalysis. Reuters reports it saying that some addresses in the leaked data were ones it was already tracking, and that "certain leaked SRG addresses sit downstream of millions of dollars in ransomware payments". That is a statement about wallet addresses by a firm that sells blockchain analytics. It is not a test of the chats, the script or the roles, which are the parts Check Point analyses. On currency, a leaked playbook can be genuine and still out of date, and Check Point does not date the messages. What Check Point can say, and does, is that the method matches what the FBI, Mandiant and Unit 42 documented before the leak.

The numbers, labelled derived, and what each cannot tell you

Check Point states no dwell time, no exact count of documents or messages and no ransom range, so the figures that can be computed are about dates, roles and samples. Each is labelled derived, with the working. The leak's date is Check Point's "around 5 October 2026", so every day count that starts there is approximate.

Figures derived for this briefing from the dates and counts in the sources named. Working shown; what each does not show is in the last column.

Figure (derived)	Working	What it does not show
4 days	Leak, around 5 October, to Check Point's post, 9 October.	The exact leak date, or how long Check Point had the material before publishing.
7 days	Leak to Infosecurity Magazine's report, 12 October, which is also the date of this briefing. Check Point's post to that report: 3 days.	That the files were verified in that time. Check Point still treats them as unverified.
84 per cent	42 divided by 50: law firms among the 50 most recently observed victims. The other 8 are 16 per cent.	The group's share over its whole history, the period of the 50, or any UK victim.
93	69 plus 22 plus 2: Check Point's sector classifications.	Check Point calls them classifications and does not say whether one victim can carry more than one, or over what period.
9 against 17	Comparitech's Q3 2026 group table lists the group at 9 claimed attacks (1 confirmed, 8 unconfirmed) against 17 in Q2: down 47.1 per cent (derived: 9 minus 17, over 17).	The group's size. Comparitech counts claims per quarter and Check Point's 50 are "most recently observed": two counters that cannot be compared.
4 roles, 5 stages	Counted from Check Point's role list and its workflow figure.	Headcount, or that five stages happen in five places: stages 2 and 3 overlap in time.
132 and 122 days	The FBI's FLASH (26 May 2026) and Mandiant's report (5 June 2026) came 132 and 122 days before the leak.	That the leaked script matches those reports in detail. Check Point calls the approach "consistent with publicly documented Luna Moth activity".
72 hours	Mandiant says extortion letters give a three-day deadline: 3 times 24 is 72, the same figure as the ICO's notification limit.	That a UK victim's two clocks start together. The ICO's runs from awareness of the breach.

This site's briefing on Comparitech's Q3 2026 ransomware tally sets out the gap between claimed and confirmed attacks in that tally. Here the group is a small row in a large table: 9 of 2,627 attacks, or 0.34 per cent (derived). That is a count of leak-site claims in one quarter. It is not a measure of harm to the law firms Check Point says it targets.

One call, two operators: the chain Check Point reconstructs

Check Point's report lays the operation out in five stages (derived count: 5): target research and persona building; a vishing call and victim-authorised access; technical collection and data theft; victim management and negotiation; and monetisation. It names four roles. It says the chain combines behaviour already documented by the FBI, Mandiant and Unit 42 with detail alleged by the leak, and that it "does not reproduce the leaked script or operational instructions". Neither does this briefing.

The new detail, in Check Point's words, is that the call acts "as the control channel that keeps the victim cooperative while access and collection occur in parallel". The remote session is not an exploit: the employee starts it. The FBI writes that recent campaigns "left few artifacts on compromised machines" and that traditional antivirus products are unlikely to flag the intrusion because the group generally uses legitimate system management or remote access tools. Check Point's own advice is organisational: verify any unexpected IT request through a separate, known channel before approving a remote session, and limit which remote access tools employees can install.

Mandiant's June 2026 report, drawn from its own incident-response cases and not from the leak, puts numbers on the tempo. In many incidents the sequence from first contact to data theft and extortion "occurred within a single business day". Data searches began in under an hour. Extortion emails came "often within 30 minutes" of the actors leaving, with a three-day deadline. One intrusion that ran through a meeting platform involved five calls to the same employee over three days, and in another incident the actors took 1.7 GB and then a further 14.4 GB (16.1 GB in all, derived). Those are Mandiant's cases. Check Point states no equivalent figure.

Four friendly names that sound like facts and are not controls

Four labels in the coverage read as facts about the group, the caller or the tool. Each describes how the attack is presented, and none is a control.

The friendly-name fallacy applied to the Luna Moth coverage. Quotations are from the sources named.

The label	What it sounds like	What the record shows
Ransomware group	A threat with a symptom: locked files and a note on a screen.	Check Point: "less as a conventional ransomware crew and more as a specialized data-extortion business", and only "if authentic". The FBI says it works without traditional encryption. A tally still counts it: 9 claims in Q3 2026.
IT support	A fact about the caller: someone whose job is to help.	The pretext. Mandiant: callers act as "members of the organization's internal IT helpdesk or security team". Check Point: research gives the caller "an identity that survives basic scrutiny". Knowing your colleagues' names shows research, not authority.
Secure remote session	A safeguard.	A framing. Check Point: remote access is "framed as a protective security check rather than an attacker's request". An encrypted, authenticated session protects the channel. It says nothing about who is on the other end, or why.
Legitimate remote access software	A fact about the tool that makes using it safe.	Unit 42: "the tools named in this post are legitimate". The FBI: use of such tools "should not be attributed as malicious without analytical evidence". The tool is legitimate; the use is not. Legitimacy belongs to the product, not to the person who asked you to run it.

The last label has a close precedent on this site. A genuine, signed installer that put a second remote tool on devices was a reminder that signed is not the same as approved. A software list that asks only whether a tool is genuine will pass every product the FBI names. A list that asks whether IT approved this tool, for this person, today, will not.

The UK: what the NCSC's guidance covers and what it leaves to you

No UK victim of this group, and no statement about it by the NCSC, the National Crime Agency or the ICO, was found in the searches made for this briefing. The FBI's products and Mandiant's campaign concern organisations in the United States, and Check Point's report mentions an ambition in the chats to target "the top 100 law firms globally", which is a statement about the leak and not a UK finding. The NCSC's public guidance on scam phone calls (published 26 November 2021, reviewed 5 September 2022) is written for "You & your family" and describes callers "pretending to be from an organisation you trust, such as your bank or the police". It does not address a caller posing as the help desk to staff. The UK relevance is the method, which does not depend on the country: a phone call, a person who will start a remote session, and software that the machine lets them run.

What UK public bodies' pages say, as read on 12 October 2026, against what they do not cover. Page dates are those printed on the pages.

UK source, as read	What it says	What it does not cover
NCSC, Phishing attacks: defending your organisation (published 5 February 2018, reviewed 13 February 2024)	"Phishing mitigations often place too much emphasis on users being able to spot phishing emails." It asks for "an effective process for users to report phishing" and no "punishment or blame-oriented culture". It suggests verifying important email requests by a second type of communication, such as a phone call, and limiting administrator accounts. ([page](https://www.ncsc.gov.uk/guidance/phishing))	Email and text phishing. A phone call appears only as a verification channel. Nothing on a caller asking staff to start a remote session.
NCSC, Mitigating malware and ransomware attacks (published 13 February 2020, reviewed 9 September 2021)	Centrally manage devices "in order to only permit applications trusted by the enterprise to run on devices". Remote access advice concerns exposed services and VPNs. Organisations should "minimise the impact of data exfiltration". ([page](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks))	A user starting an outbound support session. The page was last reviewed in 2021.
NCSC, Incidents impacting retailers (4 May 2025)	Organisations are urged to "review helpdesk password reset processes, including how the helpdesk authenticates staff members credentials before resetting passwords". ([page](https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers))	The reverse direction: a caller who claims to be the help desk, talking to staff.
NCSC and NCA white paper, Ransomware, extortion and the cyber crime ecosystem (file dated September 2023)	"More recently, some groups conduct data theft and extortion only, without deploying ransomware." The victim "can be liable for not protecting the data, regardless of whether it becomes public on the leak site". ([paper](https://www.nationalcrimeagency.gov.uk/who-we-are/publications/672-ransomware-extortion-and-the-cyber-crime-ecosystem/file))	Any named group. It pre-dates the FBI's and Mandiant's reports on this one.

Read together, these pages cover a help desk fooled by a caller who claims to be staff, email phishing, which applications may run, and the law on stolen data. None covers an employee fooled by a caller who claims to be the help desk. So the control that survives that gap is not an instruction to spot the call. It is that installing software, and starting a tool that hands over control of the machine, require a path that a caller cannot supply.

Cyber Essentials v3.3 and the control a caller cannot supply

The Requirements for IT Infrastructure v3.3 (April 2026, 26 pages) were read for the technical controls the brief names. The relevant text, as read:

• Malware protection. An organisation must use "at least one of the options": anti-malware software, or application allow listing. Allow listing means "Only approved applications, restricted by code signing, are allowed to execute on devices", and the organisation must "actively approve such applications before deploying them" and ensure "users must not be able to install any application that is unsigned or has an invalid signature".
• Secure configuration. Organisations must "remove or disable unnecessary software (including applications, system utilities and network services)".
• User access control. Accounts must "provide access to only those applications, computers and networks that the user needs to carry out their role", administrative activity needs separate accounts, and MFA is required "where available".
• Firewalls. The text requires the organisation to "block unauthenticated inbound connections by default".
• Absent. A search of the text for remote support, screen sharing, social engineering, phishing, help desk and callback found no wording on any of them. Remote working, remote administration of firewalls and suppliers' remote administration are covered, and the zero trust note mentions remote access. None concerns a user starting a support session.

Three readings follow, each labelled as inference. First, an organisation can meet the malware control with anti-malware alone, and the FBI says antivirus is unlikely to flag these tools, so a certificate does not imply that an unapproved remote tool cannot run. Second, where allow listing is chosen, the code-signing half of the wording admits any validly signed tool, and only the approval half excludes an unapproved one: a legitimate remote tool is signed. Third, a remote session that the employee starts is an outbound connection, so the firewall rule that Cyber Essentials tests, which is about inbound connections, does not apply to it. Unit 42's 2022 report adds a useful limit on the user access control: where the employee lacked administrative rights, the actors skipped installing a persistent tool and used a portable file-transfer tool that needs none. Separating administrator rights limits persistence. It does not limit theft of whatever the employee can already reach.

Extortion without encryption: the missing alarm, the 72 hours and the payment

The NCSC's ransomware page tells readers how to know whether they have been hit: "In a ransomware attack, you won't be able to access your device and the data stored on it because the files are encrypted." A group that "generally skips encryption" fails that test, so (inference) any alarm built on locked or renamed files will not fire. The NCSC's malware and ransomware guidance is broader: it says ransomware can leave data "stolen, deleted or encrypted", and that organisations should minimise the impact of data exfiltration. The symptom test and the definition are on different pages.

The ICO's guide to personal data breaches says: "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it." Its reporting page adds that the ICO understands a full picture may not be possible in 72 hours, but "you're legally required to meet this timeframe" and should provide whatever is known, with the rest later. For theft with no outage, the first sign may be an extortion email, which Mandiant says often arrives within 30 minutes of the actors leaving, or a call to a client, which the FBI says the group makes. It is reasonable to treat either as the moment the 72 hours may have started (inference). The three-day deadline in Mandiant's letters is 72 hours (derived), so the criminal's clock and the regulator's can start together. The ICO's guide also quotes recital 85 of the UK GDPR, which lists "loss of confidentiality of personal data protected by professional secrecy" among the damage a breach can cause. That describes the position of data a law firm holds for its clients (inference).

On payment, the NCSC's ransomware page says: "The NCSC and UK law enforcement do not encourage, endorse nor condone the payment of ransom demands." The NCA's cybercrime page repeats it as "Law enforcement does not encourage, endorse nor condone the payment of ransom demands." That page carries an "Expired" label in its header, so the NCSC's page is the one relied on. The NCSC's guidance for organisations considering payment (14 May 2024, jointly developed with insurance industry bodies) says: "Where possible, consult experts", names insurers, the NCSC, law enforcement and incident response companies, and says to consider taking legal advice and whether to disclose to the ICO. It warns that payments "may not be lawful" if made to a sanctioned entity or area, and that "you cannot trust a promise to delete it once a ransom is paid". Its heading "Know that paying a ransom does not fulfil your regulatory obligations" cites the ICO as not considering a payment a risk mitigation or a reason to reduce a penalty. Unit 42 saw the same: in 2022, paying "did not guarantee they would follow through". Note that the NCSC guidance is written around encryption ("uses malware to encrypt files"), so a victim of data theft alone has to read it by analogy.

What to do, in the order worth doing

Every item is a control that the FBI, Mandiant, Check Point, the NCSC or the ICO names, and none needs the leak to be genuine: the FBI and Mandiant described this pattern before the leak. The first two items are the ones that break the chain on the day, because they make the call fail even when it is convincing.

What could not be verified

• The files. Nothing in the record shows the archive is authentic. Chainalysis, via Reuters, speaks only to wallet addresses. The leak and its files were deliberately not opened, so every statement about their content is Check Point's.
• Chainalysis. Its own post was not opened. Its words are as Reuters reports them, from a syndicated copy of the Reuters story. This briefing prints no payment figure that Chainalysis or Reuters gives, because Check Point states none and the site's own total does not reconcile.
• Check Point's figures. The 42 of 50, the sector classifications and the role list were read as text in the report and blog. Figure images in the report were not examined. The blog's page data shows a last-modified date of 11 October 2026, two days after publication, so its wording may have been revised.
• Group names. Check Point uses Silent Ransom Group, Luna Moth and UNC3753, and the FBI and Mandiant add Chatty Spider. Other tracking names were found only in secondary sources and are not used. No Microsoft or Sophos page on this group was found.
• The FBI's web page. The page for the 26 May 2026 FLASH answered curl with a block and was not worked around. The PDFs on the IC3 site were read instead.
• The NCA page. Its header carries an "Expired" label. The sentence quoted from it also appears on NCSC pages.
• UK. No UK victim of this group, and no NCSC, NCA or ICO statement about it, was found in the searches made. That is not proof that none exists.
• Time-stamped. Sources were read between 20:22 and 20:46 BST on 12 October 2026. A page's wording, or a new report on the leak, could change within hours.

The question that exposes the gap

If someone who knew your staff's names and your clients' matters phoned an employee this afternoon and asked them to start a remote session, what, other than that employee's judgement on a live call, would stop the software from running, and who would know within the hour?

Key facts