Extortion Group Luna Moth Flits Into Law Firms a Second Time

The cybercriminals are retargeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.

A data extortion outfit has returned to previously targeted law firms for a second go, via a “vishing”-based social engineering campaign where they purport to be IT staff.

That’s according to the ReliaQuest Threat Research team, which today published a blog post disclosing that Luna Moth, a threat extortion group that has targeted law firms since at least mid-2023, has for now abandoned remote-management tools and manual exfiltration to steal data, instead looking to swindle victims out of access tokens. Then, they’re using said tokens to access and steal information.

Joseph Keyes, blog author and cyber threat intelligence analyst at ReliaQuest, wrote that this latest wave of targets are “likely” those that didn’t pay Luna Moth’s first extortion demand, with this second hit coming weeks-to-months later.

A ReliaQuest spokesperson tells Dark Reading that these firms were targeted a second time because the group knows these organizations can be socially engineered (so it tries again with different tactics), for a second set of data. Moreover, as fewer organizations are paying, law firms make a good fit to target, because “their client data is highly sensitive and the reputational hit from exposure is severe, so repeated leverage is worth the effort.”

How Luna Moth’s New Token-Theft Campaign Works

In the initial variants of the attack, Luna Moth would reach out as IT support and trick victims to connect to Windows built in remote assistance tool. It would then download data directly. This time, the group sent black-subject emails from a free email address with a broken PDF masquerading as a business report; the “report” would then fail to open. The attacker would use this pretext to reach out soon after, posing as IT support responding to a malicious alert, while at the same time offering to fix the PDF.

Once on a video call, the “IT support” directs the target to turn on screen-share functionality so they can direct the target through a “fix.” The attacker then tells the target to open Microsoft Copilot from the Web browser in their work laptop, open the browser’s developer tools, find the request Copilot sends to Microsoft Graph, and copy the application’s access token.

The attacker instructs the target to paste the token into a public text-sharing site the attacker can access. Finally, the attacker gives the token to its own folder and downloads files through the Microsoft Graph API.

Luna Moth’s Attack Reflects a Control Gap for Organizations

This social engineering tactic requires no malware and no vulnerability. It relies solely on tricking a target into giving an access token, effectively a master key into the front door of an organization. The use of IT support to “fix” a technical issue evokes ClickFix, as both techniques rely on human problem-solving tendencies to trick an end user.

The ReliaQuest spokesperson says the firm considers this attack representative of a gap in how controls are scoped within an organization. Because the token is issued to the victim’s compliant device and handed over “willingly,” security red flags do not go off.

“A token is a bearer credential, so it works from anywhere until it expires, unless CAE [Continuous Access Evaluation] with strict location enforcement (or token binding) applies,” the spokesperson says. “Similar to device code phishing, the user completes a legitimate flow, so MFA is satisfied. The weakness is the assumption that authentication equals ongoing trust. Microsoft’s defaults, such as the 60- to 90-minute lifetime and CAE not being enforced by default, make it easier.”

ReliaQuest recommends that organizations turn CAE on by default, block browser developer tools and token-inspection pages on managed browsers, and restrict remote-support and screen-sharing tools where there’s no business need. Additionally, it may be wise to inform employees of the ways threat actors attempt to steal credentials from employees.

As the blog put it, “Tell users that IT will never ask for developer tools or tokens and that they should verify IT requests by callback.”

Originally published on Dark Reading