CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Silent Ransom Group

actor · actor:silent-ransom-group single-source

Data-extortion group, also tracked as Luna Moth and UNC3753, that has targeted law firms since at least mid-2023 and, per ReliaQuest (2026-11-12), returned in October and early November 2026 to law firms that appear not to have paid, using a video-call help-desk impersonation that has the employee hand over a Microsoft Graph access token; earlier reporting in the store covers its vishing, remote-tool and physical-USB tradecraft.

Aliases: SRG, Luna Moth, UNC3753

Coverage
3
1 about it · 2 mentions · first 2026-05-28 → last 2026-11-14
Latest activity
2026-11-14
ReliaQuest: Luna Moth has staff hand over a Graph token from Copilot on a video call; no sign-in event follows
Peak priority
notable
1 notable
Targets
legal-services
sectors: legal-services
Sources cited
16
9 hosts
2026-05-283 appearances2026-11-14

Defender insights

What each entry about Silent Ransom Group tells a defender to do, newest first.

2026-11-14NOTABLEReliaQuest: Luna Moth has staff hand over a Graph token from Copilot on a video call; no sign-in event follows

Exposure · detection

Story timeline

Every entry that names Silent Ransom Group, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-11-14Luna Moth returns to law firms that likely did not pay, with a token handoff: a video-call 'IT support' agent has the employee copy a Microsoft Graph access token out of Microsoft 365 Copilot through browser developer tools, then bulk-downloads files from the attacker's own server (ReliaQuest)
    active-threatsReliaQuest: Luna Moth has staff hand over a Graph token from Copilot on a video call; no sign-in event follows
  2. 2026-06-06Luna Moth / Silent Ransom Group (UNC3753): vishing-to-physical-access data-theft extortion against legal and professional services
    mentiondeep-dive
  3. 2026-05-28FBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social engineering fails
    mentionactive-threatsFBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social

Hunting pivots

Affected products
Microsoft 365Microsoft Graph
Tags
identityphishing
ATT&CK techniques (5 across 5 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessPhishing: Spearphishing Voice
  • StealthSocial Engineering: Impersonation
  • Credential AccessSteal Application Access Token
  • Lateral MovementUse Alternate Authentication Material: Application Access Token
  • CollectionData from Cloud Storage

Initial Access TA0001

T1566.004Phishing: Spearphishing Voice×1

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.

Evidence: 2026-11-14/luna-moth-token-handoff-copilot-graph-token-law-firms · ATT&CK page ↗

Stealth TA0005

T1684.001Social Engineering: Impersonation×1

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.

Evidence: 2026-11-14/luna-moth-token-handoff-copilot-graph-token-law-firms · ATT&CK page ↗

Credential Access TA0006

T1528Steal Application Access Token×1

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-11-14/luna-moth-token-handoff-copilot-graph-token-law-firms · ATT&CK page ↗

Lateral Movement TA0008

T1550.001Use Alternate Authentication Material: Application Access Token×1

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-11-14/luna-moth-token-handoff-copilot-graph-token-law-firms · ATT&CK page ↗

Collection TA0009

T1530Data from Cloud Storage×1

Adversaries may access data from cloud storage.

Evidence: 2026-11-14/luna-moth-token-handoff-copilot-graph-token-law-firms · ATT&CK page ↗

Entries about Silent Ransom Group (1)

2026-11-14 · view entry permalink →

NOTABLENATOB3

Luna Moth returns to law firms that likely did not pay, with a token handoff: a video-call 'IT support' agent has the employee copy a Microsoft Graph access token out of Microsoft 365 Copilot through browser developer tools, then bulk-downloads files from the attacker's own server (ReliaQuest)

ReliaQuest says Luna Moth, also called Silent Ransom Group, has targeted law firms since at least mid-2023 and in October and early November went back to firms it had extorted in May and August; those firms appear on the group's leak site, which ReliaQuest says suggests they likely did not pay, and the group exfiltrated a second round of data (ReliaQuest, 2026-11-12). The approach reverses the group's earlier flow: a blank-subject email from a free address carries a deliberately invalid PDF that crashes the viewer, and the attacker then calls the target, often on a personal number outside corporate call controls, posing as IT support responding to a "malicious email" (ReliaQuest, 2026-11-12). By late August the group paired video calls with a built-in remote-assistance tool, and by October the video call alone carried both the conversation and the screen control (ReliaQuest, 2026-11-12).

On the call the attacker has the employee open Microsoft 365 Copilot in the browser on a managed, compliant laptop, open the browser's developer tools to find the request Copilot sends to Microsoft Graph and copy the access token it carries, and paste the token into a public text-sharing site where the attacker retrieves it (ReliaQuest, 2026-11-12). Within a minute the attacker replays the token from its own server and downloads files en masse through the Graph API, thousands in about an hour (ReliaQuest, 2026-11-12). The stolen token passes Conditional Access because the device check runs only at sign-in, not when the token is later used, and, unlike device-code phishing, the token is issued to the victim's compliant device and then handed over (ReliaQuest, 2026-11-12). Nothing is installed, and the video-call applications are signed legitimate software (ReliaQuest, 2026-11-12).

This token-based exfiltration is almost certainly a new tactic for the group.

Attackers never have to authenticate, so no sign-in events are generated for their address.

In the observed intrusions, the first download from attacker infrastructure came about a minute after the token was copied.

ReliaQuest 2026-11-12

Builds on: Luna Moth / Silent Ransom Group (UNC3753): vishing-to-physical-access data-theft extortion… · FBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices…

threat14 Nov 03:55Zsingle-sourceOpen finding →
Sources: ReliaQuest

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2
  • Deep dive1

Source distribution

  • attack.mitre.org8 (50%)
  • bleepingcomputer.com1 (6%)
  • cloud.google.com1 (6%)
  • cyberscoop.com1 (6%)
  • helpnetsecurity.com1 (6%)
  • legalcheek.com1 (6%)
  • reliaquest.com1 (6%)
  • securityaffairs.com1 (6%)
  • other1 (6%)
All cited sources (16)