Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Assessment: Luna Moth Callback Phishing Campaign

Summary: Unit 42 investigated incidents from mid-May to late October 2022 in a callback phishing extortion campaign attributed by Sygnia to a threat actor dubbed Luna Moth, in which attackers email a fake invoice under $1,000, route callers to a live call-center agent, and use legitimate tools such as Zoho Assist, Syncro, Rclone and WinSCP to exfiltrate data without deploying malware. Demands ranged from 2 to 78 BTC with roughly 25% discounts offered for prompt payment, and victimology shifted from small- and medium-sized legal businesses early in the campaign to larger retail targets later.

Why it matters: The campaign cost victims hundreds of thousands of dollars, and paying did not guarantee deletion: attackers sometimes stopped responding after confirming payment and never provided proof of deletion. Because the attack runs on trusted remote-support and file-transfer tools that antivirus is unlikely to flag, an employee calling a number printed on a PDF is the entire intrusion path.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Phishing & Social Engineering
Related