As reported by Dark Reading, the extortion group known as Luna Moth has begun retargeting law firms that previously refused to pay initial ransom demands. This second wave of attacks leverages social engineering specifically aimed at stealing Microsoft access tokens — a significant tactical shift that warrants careful examination by defenders across the professional services sector.
The 'Second-Bite' Problem
What makes this campaign noteworthy is not just the social engineering technique itself, but the economic model it represents. Traditional ransomware logic assumed that refusing to pay would eventually lead the attacker to move on. Luna Moth's retargeting strategy upends that assumption. By returning to organizations that demonstrated willingness to weather a first incident, the group is essentially testing whether persistence and a different attack vector can break resilience that financial stubbornness alone could not.
This creates a new calculus for victim organizations: refusing payment is no longer a definitive exit from the threat. Defenders and incident response teams must now assume that non-payment may lead to follow-on campaigns weeks or months later, potentially using entirely different intrusion methods.
Why Access Token Theft Matters
The pivot to Microsoft access token theft is the most technically significant aspect of this campaign. Unlike credential theft — where a username and password can be reset — stolen access tokens can remain valid until they expire or are explicitly revoked. This means:
For law firms specifically, where client privilege, litigation strategy, and M&A documentation may all live in Microsoft 365, a single stolen token can equate to catastrophic data exposure — the exact leverage extortion groups need.
Who Is at Risk
While law firms are the current target, any organization that has previously refused to pay an extortion demand should consider itself a potential Luna Moth return target. Professional services firms, financial advisory groups, and healthcare organizations with prior incidents are all exposed. Additionally, organizations heavily reliant on Microsoft 365 for document collaboration — where a single user token grants broad data access — face heightened risk from this specific tactic.
Shield53 Recommendations
Immediate Actions
- Audit and revoke suspicious OAuth tokens: Review Microsoft 365 admin center for active user sessions and OAuth application grants. Revoke any sessions or app consents that cannot be clearly justified
- Implement Conditional Access session controls: Enforce sign-in frequency policies and use session lifetime limits to shorten the window in which a stolen token remains useful
- Enable Microsoft's token protection features: Deploy Continuous Access Evaluation (CAE) where supported and configure token theft detection capabilities in Entra ID
- Brief all staff on the callback phishing pattern: Luna Moth social engineering typically involves fake support calls or subscription-related emails that prompt users to grant access. Train staff to verify any unsolicited access request through internal IT channels
Strategic Hardening
- Conduct a post-incident threat hunt for any organization that experienced a prior extortion event — look specifically for token-based persistence mechanisms that may have survived the original remediation
- Restrict third-party application registrations in Microsoft 365 to reduce the attack surface for malicious OAuth consent flows
- Implement just-in-time access for administrative accounts and reduce standing privileged role assignments that could be abused via stolen tokens
- Develop a 'second-incident' response playbook that assumes return campaigns may use different TTPs than the initial intrusion — do not assume your previous remediation covers all future attack paths
The lesson from Luna Moth is clear: incident closure is not threat closure. Organizations that survive one extortion attempt must treat themselves as actively targeted until they can verify that no residual access paths remain — and then maintain that vigilance indefinitely.
As extortion groups continue to refine their business models, defenders must similarly evolve their post-incident assumptions. The era of 'they moved on' is giving way to 'they'll be back' — and your access token hygiene may determine whether the second visit succeeds.
