One paid $20 million to keep client files off the internet.
That group is Luna Moth, also tracked as Silent Ransom Group and UNC3753. The FBI issued a flash alert about it to US law firms in May. There’s no zero-day here and no ransomware payload. The entire operation runs on a phone call.
No tool in the firm’s stack will register that anything happened. Every action in the session is legitimate on its own, and on its own is how a content scan or a rule engine sees it. But the pattern those actions form is not legitimate. Jazz was built to catch exactly that.
The attack chain
It starts with an invoice.
A fake one arrives in an inbox, large enough to cause concern, with a phone number to call and dispute the charge. Someone at the firm calls.
The person who picks it up says there’s suspicious activity on the account. They’re from security. They need to verify something, can you share your screen? Then, to fix it properly, can you install the support tool? It is AnyDesk, or Zoho Assist. Real software, signed, used by IT departments everywhere.
From there the attacker searches iManage directly. Client files, M&A documents, litigation strategy, all of it sitting in the system your firm runs on. They find what they came for, stage it in the Downloads folder, and upload it to a personal cloud account from the employee’s own browser.
Sometimes they never touch the keyboard at all. They stay on the phone and walk the employee through each step. The ransom email arrives within the hour.
Why existing DLP sees nothing
Every element of that session is legitimate.
The account is authenticated. The employee is real and authorized. iManage is a sanctioned system. The browser is approved. The documents are ones that person has every right to open.
Content inspection has nothing to flag, because the content was never the problem. Pattern matching has nothing to match, because no pattern was violated. There’s no malicious binary to detect and no encryption event to trigger on.
Existing DLP logs a clean session. The files are already gone.
This is the part worth sitting with. The attack didn’t defeat the security stack by being more advanced than it. It defeated the stack by looking exactly like work.
Jazz is built to see the full story
The only thing that catches this is understanding the person behind the session.
Jazz knows who the people are, which matters they work, and where the firm’s trust boundary actually runs. Not the policy describing how work is supposed to happen. What the business does every day.
We observe the session the way the employee experiences it: the screen share, the search inside iManage, the volume of documents pulled, the staging in Downloads, the upload leaving through the browser. The full session context, captured as it happens rather than reconstructed afterward.
Melody, our agentic investigator, then does what an analyst would do if an analyst had time to examine every data movement in the firm. It investigates across four dimensions:
The data. What are these documents? Are they tied to active matters? Is this a set of files that belong together, or a collection someone assembled?
The systems. iManage, browser, cloud storage. Jazz distinguishes a corporate account from a personal one, which matters enormously here, the destination is the tell.
The person. What is this individual’s role? Which matters do they work? Do they normally access this volume? Have they ever moved client files to personal storage before?
The business. Is this a known workflow? Does the firm have a legitimate reason for client files to travel this path?
A paralegal opening documents for their own matters is work. That same person pulling files across unrelated matters and pushing them to a personal cloud account during a remote session is a different story entirely — and Jazz can tell the difference on day one, with nothing written in advance.
When the judgment is clear, Jazz blocks with precision rather than shutting down the session wholesale. When it’s genuinely ambiguous, the investigation reaches a human with the full reasoning attached.
The uncomfortable question: Would your firm know?
Luna Moth works because it exploits the gap between what your tools can see and what they can understand.
If a session started at your firm tomorrow, authenticated user, sanctioned system, approved browser, real client files, would your DLP know the difference between a paralegal working late and someone on the phone being walked through an exfiltration?
Most firms don’t know the answer. Neither did the firm that paid $20 million. That’s worth finding out before someone else does.
