The cybercriminal group known as Luna Moth is reportedly targeting law firms again, focusing on organizations that declined to pay a ransom during an earlier incident. The renewed effort uses social engineering intended to steal Microsoft access tokens, according to the available account of the activity.
The reported targeting connects two persistent risks for legal practices: repeat extortion attempts and the compromise of credentials or tokens that can provide access to cloud services. The details available do not identify the firms, describe the initial incidents, or explain the specific messages and techniques used in the latest approach. They also do not establish how many organizations have been contacted or whether any accounts were successfully accessed.
Why access tokens matter
Access tokens are used by applications and services to represent an authenticated session or authorize particular actions. If an attacker obtains a valid token, it may provide a way to access resources without simply asking for a user’s password. The exposure and usefulness of a token depend on factors such as its permissions, lifetime, and the controls enforced by the service. Token theft is therefore distinct from ordinary password harvesting, even when social engineering is the route used to obtain it.
For law firms, account access can have consequences beyond email. Legal organizations handle confidential client communications and documents, and their cloud accounts may connect employees to collaboration tools and other business services. The reported campaign’s focus on firms that previously refused payment also underscores that rejecting an extortion demand does not necessarily end an attacker’s interest in an organization.
Identity controls and response
Organizations should treat unexpected requests involving account access, authentication, or Microsoft services with caution. Employees should verify unusual instructions through a separate, trusted channel rather than relying on contact details or links included in an unsolicited message. Staff awareness is useful, but it cannot replace technical controls that limit the impact of a compromised identity.
Identity teams can review access policies, restrict permissions to what users and applications need, and monitor sign-in activity for unusual behavior. Where supported, controls that assess device state and sign-in risk can add safeguards around access to sensitive services. Administrators should also understand how their organization revokes active sessions and tokens, and include those steps in incident-response procedures.
If a user reports a suspicious interaction, security teams should investigate the account and related activity promptly. That may include reviewing authentication records, checking for unauthorized changes, and revoking sessions or credentials when warranted. The specific response should be guided by evidence from the affected environment; the limited description of the Luna Moth activity does not support conclusions about particular indicators or a single technical remediation.
What remains unknown
The available report identifies the alleged target group, the repeat-extortion context, and the intended theft of Microsoft access tokens through social engineering. It does not provide enough detail to assess the campaign’s scale, identify its exact lures, or determine whether the approach relies on a particular Microsoft product or authentication weakness. Organizations should avoid assuming that an unreported technique is involved and instead apply established identity protections while watching for verified updates.
