Leaked internal documents attributed to Luna Moth — also tracked as Silent Ransom Group — have given defenders an unusually clear view into how a modern, encryption-free extortion operation actually runs. The material suggests a deliberately segmented operation: social engineering specialists handle initial contact and manipulation of a single target, while more technically skilled operators take over for tooling, staging, and data theft. This is not a spray-and-pray ransomware crew. It is a disciplined, low-noise intrusion team that monetizes stolen data through extortion without ever deploying a cryptor.
That model matters to every SOC reading this. Luna Moth's hallmark tradecraft — callback phishing (email lures that push victims to phone a fraudulent helpdesk), voice-based manipulation of employees, and the use of legitimate remote monitoring and management (RMM) software for hands-on access — produces a thin forensic footprint. There is no malicious payload to signature, no exploit chain to patch, and often no malware at all. Defense hinges on behavioral detection of RMM abuse, helpdesk process hardening, and outbound data transfer monitoring. This post breaks down the leaked playbook from a defender's perspective and provides concrete detection content you can deploy today.
Technical Analysis
The Two-Cell Operating Model
The leaked documents reinforce what incident responders have observed in Luna Moth engagements since the group emerged in 2022: a division of labor between social engineers and technical operators.
Cell 1 — Social Engineering / Initial Access. Operators send lure emails impersonating invoices, subscription renewals, or compliance notices, each containing a phone number rather than a malicious link or attachment. When the victim calls, a scripted agent walks them through downloading a "tool" to resolve the fabricated issue. That tool is almost always a legitimate, signed RMM or remote access product — historically Atera, Syncro, Splashtop, AnyDesk, Zoho Assist, or TeamViewer. Because the software is legitimate and user-initiated, it sails past email gateways, attachment sandboxes, and most application control defaults.
Cell 2 — Technical Operations. Once remote access is established, a different operator takes the session. Their playbook typically includes:
- Reconnaissance of file shares, document repositories, and collaboration platforms
- Deployment of additional legitimate tooling — Rclone or similar sync utilities for staged exfiltration to cloud storage (MEGA, Dropbox, pCloud, or attacker-controlled infrastructure)
- Collection of sensitive data: legal documents, financial records, PII, and anything with extortion leverage
- Extortion outreach threatening public leak unless payment is made — with no file encryption, which means no obvious "ransomware event" to trigger IR playbooks
Why This Defeats Traditional Controls
| Layer | Why It Fails Against Luna Moth |
|---|---|
| Email security | No malicious link or attachment — just a phone number |
| EDR malware detection | Signed, legitimate RMM binaries are allowlisted by reputation |
| DLP (content-only) | Exfil via Rclone to consumer cloud storage looks like normal HTTPS sync |
| IR runbooks | No encryption event; "ransomware" triggers never fire |
| User awareness (link-focused) | Users were trained not to click links, not to distrust phone numbers in emails |
Exploitation Status
There is no CVE here — this is pure technique-driven intrusion. Luna Moth / Silent Ransom Group remains an active operation as of 2026, with documented targeting of legal, financial, and professional services firms in the US and UK. The leaked playbook confirms the group is refining its scripts and tooling, not retiring them. Organizations should treat callback phishing and unauthorized RMM presence as a confirmed, in-the-wild threat pattern, not a theoretical one.
Detection & Response
SIGMA Rules
---
title: Unauthorized RMM Tool Execution
description: Detects execution of remote monitoring and management tools commonly abused by Luna Moth / Silent Ransom Group following callback phishing. Tune the allowlist to your sanctioned RMM product.
references:
- https://www.infosecurity-magazine.com/news/luna-moth-leaks-ransomware-playbook/
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\atera_agent.exe'
- '\syncro.exe'
- '\syncrolive.exe'
- '\splashtop.exe'
- '\sr_service.exe'
- '\anydesk.exe'
- '\teamviewer.exe'
- '\teamviewer_service.exe'
- '\zohomeeting.exe'
- '\za_connect.exe'
- '\screenconnect.client.exe'
- '\netwrix.exe'
- '\gotoassist.exe'
- '\logmein.exe'
filter_approved_path:
Image|startswith:
- 'C:\Program Files\ApprovedRMM\'
- 'C:\Program Files (x86)\ApprovedRMM\'
condition: selection_img and not filter_approved_path
falsepositives:
- Sanctioned IT support sessions — build an approved-path or approved-hash allowlist for your corporate RMM
level: high
tags:
- attack.command_and_control
- attack.t1219
---
title: Rclone Data Exfiltration to Cloud Storage
description: Detects Rclone execution with copy/sync/move arguments targeting remote cloud storage, a hallmark of Luna Moth staged exfiltration.
references:
- https://www.infosecurity-magazine.com/news/luna-moth-leaks-ransomware-playbook/
- https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_bin:
Image|endswith: '\rclone.exe'
selection_args:
CommandLine|contains:
- 'copy'
- 'sync'
- 'move'
selection_remote:
CommandLine|contains:
- 'mega'
- 'dropbox'
- 'pcloud'
- 'box.com'
- 'sftp'
- ':,'
condition: selection_bin and selection_args and selection_remote
falsepositives:
- Legitimate backup jobs using Rclone — scope by service account and scheduled task origin
level: high
tags:
- attack.exfiltration
- attack.t1567.002
---
title: Portable Executable Dropped and Run From User-Writable Path
description: Detects execution of remote access or transfer tooling from user-writable directories (Downloads, Temp, AppData) consistent with victim-guided installation during callback phishing.
references:
- https://www.infosecurity-magazine.com/news/luna-moth-leaks-ransomware-playbook/
- https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_path:
Image|startswith:
- 'C:\Users\'
- 'C:\ProgramData\'
- 'C:\Windows\Temp\'
selection_name:
Image|endswith:
- '\rclone.exe'
- '\anydesk.exe'
- '\teamviewer.exe'
- '\atera_agent.exe'
- '\syncro.exe'
- '\splashtop.exe'
- '\winscp.exe'
- '\filezilla.exe'
condition: selection_path and selection_name
falsepositives:
- Users running portable utilities — review parent process; browser- or Office-spawned instances are higher fidelity
level: medium
tags:
- attack.execution
- attack.t1204.002
KQL — Microsoft Sentinel / Defender
// Hunt: unauthorized RMM execution followed by potential exfil staging (Luna Moth pattern)
let RmmTools = dynamic(["atera_agent.exe","syncro.exe","syncrolive.exe","splashtop.exe","anydesk.exe","teamviewer.exe","teamviewer_service.exe","za_connect.exe","screenconnect.client.exe","logmein.exe","gotoassist.exe"]);
let ExfilTools = dynamic(["rclone.exe","winscp.exe","filezilla.exe","megasync.exe"]);
let lookback = 7d;
let SuspiciousRMM = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ (RmmTools)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","outlook.exe","explorer.exe","msiexec.exe")
| project DeviceId, DeviceName, RMMTime=Timestamp, RMMProcess=FileName, RMMCmd=ProcessCommandLine, InitiatingProcessFileName, AccountName;
let ExfilActivity = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ (ExfilTools)
| project DeviceId, ExfilTime=Timestamp, ExfilProcess=FileName, ExfilCmd=ProcessCommandLine;
SuspiciousRMM
| join kind=inner ExfilActivity on DeviceId
| where ExfilTime between (RMMTime .. RMMTime + 4h)
| project DeviceName, AccountName, RMMTime, RMMProcess, RMMCmd, ExfilTime, ExfilProcess, ExfilCmd
| sort by RMMTime asc;
// Hunt: outbound transfers to consumer cloud storage from workstations (Rclone exfil indicator)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("mega.nz","mega.co.nz","dropbox.com","pcloud.com","transfer.sh","file.io")
or RemoteIP in ("31.216.144.0/24") // example Mega range - maintain your own threat intel list
| where InitiatingProcessFileName in~ ("rclone.exe","megasync.exe","powershell.exe","cmd.exe")
| summarize Connections=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| sort by Connections desc;
Velociraptor VQL
-- Hunt for unauthorized RMM agents and exfil tooling across the fleet
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(atera|syncro|splashtop|anydesk|teamviewer|zoho|screenconnect|logmein|rclone|megasync)'
OR CommandLine =~ '(?i)rclone.*(copy|sync|move)'
-- Hunt for RMM/exfil binaries staged in user-writable directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
'C:/Users/*/Downloads/**/*.exe',
'C:/Users/*/AppData/**/*.exe',
'C:/ProgramData/**/*.exe'
])
WHERE FullPath =~ '(?i)(atera|syncro|splashtop|anydesk|teamviewer|zoho|screenconnect|logmein|rclone|megasync|filezilla|winscp)'
Remediation / Hardening Script
# Luna Moth defensive posture: audit unauthorized RMM tooling and restrict execution
# Run elevated on endpoints or deploy via your RMM/GPO pipeline
$RmmNames = @('atera_agent','syncro','syncrolive','splashtop','anydesk','teamviewer','teamviewer_service','za_connect','screenconnect.client','logmein','gotoassist','rclone','megasync')
$ApprovedPath = 'C:\Program Files\ApprovedRMM\' # Replace with your sanctioned RMM install path
Write-Host '[*] Scanning running processes for unauthorized RMM/exfil tooling...' -ForegroundColor Cyan
$findings = Get-Process | Where-Object { $RmmNames -contains $_.ProcessName.ToLower() } | Where-Object { $_.Path -notlike "$ApprovedPath*" }
if ($findings) {
$findings | Select-Object ProcessName, Id, Path | Format-Table -AutoSize
Write-Host '[!] Unauthorized remote access tooling detected. Validate against helpdesk ticket records before terminating.' -ForegroundColor Red
} else {
Write-Host '[+] No unauthorized RMM processes found.' -ForegroundColor Green
}
Write-Host '[*] Checking installed services for persistent RMM agents...' -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match '(?i)(atera|syncro|splashtop|anydesk|teamviewer|screenconnect|logmein)' } | Where-Object { $_.PathName -notlike "$ApprovedPath*" } | Select-Object Name, State, PathName | Format-Table -AutoSize
Write-Host '[*] Auditing outbound firewall policy for consumer cloud exfil domains...' -ForegroundColor Cyan
$ExfilHosts = @('mega.nz','dropbox.com','pcloud.com','transfer.sh')
foreach ($h in $ExfilHosts) {
$ruleName = "Block-Exfil-$h"
if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
$ips = (Resolve-DnsName $h -Type A -ErrorAction SilentlyContinue).IPAddress
foreach ($ip in $ips) {
New-NetFirewallRule -DisplayName "$ruleName-$ip" -Direction Outbound -Action Block -RemoteAddress $ip -ErrorAction SilentlyContinue | Out-Null
}
Write-Host "[+] Outbound block rule created for $h (verify business need before enforcing broadly)." -ForegroundColor Yellow
}
}
Write-Host '[*] Recommend: enforce WDAC/AppLocker policy restricting RMM execution to approved publisher+path. See remediation section.' -ForegroundColor Cyan
Remediation
Because Luna Moth abuses legitimate software and human trust rather than a patchable vulnerability, remediation is architectural and procedural:
-
Establish an RMM allowlist — then enforce it. Inventory every remote access product legitimately used by your IT organization, then block everything else via AppLocker or Windows Defender Application Control (WDAC) publisher/path rules. Execution of AnyDesk, Atera, Syncro, Splashtop, or TeamViewer outside the approved deployment path should alert at high severity in your SIEM, not silently run.
-
Harden the helpdesk and the phone channel. Callback phishing works because a phone number feels safer than a link to an untrained user. Update awareness training to specifically cover: invoices or renewal notices that request a phone call, any "support agent" directing software installation, and mandatory verification of unsolicited support contact through a known internal number. Require identity verification (SSPR-style callbacks to registered numbers, manager approval) before any helpdesk-guided software installation or credential reset.
-
Monitor outbound data movement, not just inbound payloads. Alert on Rclone/MEGAsync/FileZilla/WinSCP execution on workstations, new outbound sessions to consumer cloud storage from non-server assets, and sustained multi-gigabyte egress from a single endpoint. Luna Moth's entire business model fails if exfiltration is caught in the staging window.
-
Constrain egress. Deny outbound access to file-sharing and consumer sync services that have no sanctioned business use. Where exceptions exist, scope them by host and user group and log them.
-
Update your IR runbooks for encryption-free extortion. If your ransomware playbook triggers on encryption events only, Luna Moth will complete its operation without ever invoking it. Add explicit triggers for unauthorized RMM discovery, bulk access to sensitive shares by a remote session, and extortion communications received by staff. Pre-stage your legal/comms response for a data-leak threat with no encrypted systems.
-
Threat hunt on a standing cadence. The join query above (user-initiated RMM install followed within hours by transfer tooling) is the single highest-fidelity hunt for this actor. Run it weekly, and treat any hit as a full IR scoping exercise — check what shares the remote session touched, what data left, and whether the extortion clock is already running.
The leaked playbook is a gift to defenders: Luna Moth's model is predictable, repeatable, and entirely dependent on a handful of detectable behaviors. Break the RMM execution path or the exfiltration path, and the operation collapses before the ransom note ever arrives.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.