Luna Moth

Reports per quarter

CVEs named in reports

• CVE-2021-34687
• CVE-2021-40539 KEV ransomware
• CVE-2022-41040 KEV ransomware
• CVE-2022-41080 KEV ransomware
• CVE-2022-41082 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   BazarBackdoor (Malware Family)

   date ORKL added it fromORKL

   The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BazarBackdoor (Malware Family)

2. 6 April 2026

   Conti (Malware Family)

   date ORKL added it fromORKL

   The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Conti (Malware Family)

3. 28 December 2022

   PLAYing the game

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PLAYing the game

4. 28 December 2022

   PLAYing the game

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor PLAYing the game

5. 21 November 2022

   Threat Assessment: Luna Moth Callback Phishing Campaign

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Threat Assessment: Luna Moth Callback Phishing Campaign

6. 21 November 2022

   Threat Assessment- Luna Moth Callback Phishing Campaign

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Assessment- Luna Moth Callback Phishing Campaign

7. 11 August 2022

   State of the Remote Access Tools, Part 1

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor State of the Remote Access Tools, Part 1

8. 11 August 2022

   “BazarCall” Advisory- Essential Guide to Attack Vector that Revolutionized Data Breaches

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor “BazarCall” Advisory- Essential Guide to Attack Vector that Revolutionized Data Breaches

9. 1 July 2022

   Luna Moth Ransomware: The Threat Actors Behind Recent False Subscription Scams

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Luna Moth Ransomware: The Threat Actors Behind Recent False Subscription Scams

10. 1 July 2022

    Luna Moth- The Actors Behind the Recent False Subscription Scams

    date in the title fromORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Luna Moth- The Actors Behind the Recent False Subscription Scams

Newest first. Details opens the report in Explore.