Threat actors from the Luna Moth threat group have been conducting an extensive callback phishing extortion operation targeting end-users throughout retail and legal industries. Luna Moth, also tracked as the Silent Ransom Group, has been active since the end of March 2022 and has crafted a reputation for conducting data extortion attacks where the group will leak stolen data archives if ransom demands are not promptly met. This social engineering campaign relies heavily on call back phishing, often referred to as a telephone-oriented attack delivery (TOAD), with the end goal of utilizing legitimate and trusted device management applications for direct host access. Once routed into the host device, Luna Moth actors exfiltrate data from the system to be used for extortion purposes. Since the applications and associated tooling are validated applications, traditional anti-virus applications will typically not flag them as malicious. As a lure to entice victims, Luna Moth actors distribute phishing emails displaying an invoice indicating an employee’s credit card has been charged for a service. The phishing email itself is not typically malicious, however if the end-user calls the attached phone number, they are routed to a threat actor-controlled call center with live agents. Agents will then convince the end-user to allow support teams to remote into their computer to fix the issue, while downloading exfiltration scripts and tooling to the compromised machine. Once the data has been stolen, victims will receive an email demanding payment for the release of files, otherwise the data will be released for public download. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.