INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Deploying Kaolin RAT via Spear-Phishing

| 2026-10-11 13:51 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A researcher discovered a misconfigured MongoDB instance in August 2026 that left Rocket.Chat records exposed, with data being publicly available until September 28, 2026. The researcher contacted DataBreaches after the incident was reported to them by another individual who had knowledge of it; this person is not named due to potential retaliation concerns. Chat data were leaked on an IP address in Lithuania and matched what the researcher discovered, but the identity of those who downloaded the data remains unknown.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
sl•••••.com
ai•••••.com
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎September 28, 2016
Screenshots of chat data were inadvertently shared on an IP address in Lithuania, exposing the information on September 28, 2016.
organisation Screenshots
Screenshots provided by the researcher and redacted by DataBreaches show that on August 24, 2026, and September 28, 2016,  Rocket.
organisation IP
Chat data were exposed on an IP address in Lithuania.
‎August 25, 2025
The Luna Moth Files, which were leaked from a MongoDB instance that was left open for over a month without notification to SRG's top leadership, represent a data breach.
observable aim6umein3kee.com
We also know the messages in the files have date stamps consistent with the fact that slplsskdj2836v2jjsx[.]com was registered on September 1, 2026—the first date we see messages on that domain—and the aim6umein3kee[.]com domain was registered on August 25, 2025 — two days before the first message we see on that server.
observable slplsskdj2836v2jjsx.com
We also know the messages in the files have date stamps consistent with the fact that slplsskdj2836v2jjsx[.]com was registered on September 1, 2026—the first date we see messages on that domain—and the aim6umein3kee[.]com domain was registered on August 25, 2025 — two days before the first message we see on that server.
organisation Signal
Email us at breaches@databreaches[.]net or contact us on Signal at Dissent[.]73.
organisation NameCheap
Both domains were registered with NameCheap and are behind Cloudflare.
organisation Cloudflare
Both domains were registered with NameCheap and are behind Cloudflare.
organisation the Luna Moth Files
We don’t know the answers to those questions, but it now seems indisputable that the Luna Moth Files represent a leak, and that any claims by SRG that the data are “fake” are meritless.
The Luna Moth Files provide a great deal of material for researchers and law enforcement.
data_breach 29 September
Did whoever secured the MongoDB instance on or about September 29  ever tell SRG’s top leadership that the instance was open for more than a month, or did someone try to cover up their mistake by not saying anything?
‎no later than August 2026
The Luna Moth Files data were exposed no later than August 2026.
‎August 24, 2026
Screenshots of the MongoDB "rocketchat" were open on August 24, 2026.
organisation Screenshots
Screenshots provided by the researcher and redacted by DataBreaches show that on August 24, 2026, and September 28, 2016,  Rocket.
‎September 1, 2026
Slplsskdj2836v2jjsx.com was registered two days before the first message on its server appeared, consistent with messages in leaked Luna Moth Files also having date stamps from September 1, 2026.
observable aim6umein3kee.com
We also know the messages in the files have date stamps consistent with the fact that slplsskdj2836v2jjsx[.]com was registered on September 1, 2026—the first date we see messages on that domain—and the aim6umein3kee[.]com domain was registered on August 25, 2025 — two days before the first message we see on that server.
observable slplsskdj2836v2jjsx.com
We also know the messages in the files have date stamps consistent with the fact that slplsskdj2836v2jjsx[.]com was registered on September 1, 2026—the first date we see messages on that domain—and the aim6umein3kee[.]com domain was registered on August 25, 2025 — two days before the first message we see on that server.
‎September 28, 2026
The Luna Moth Files data were exposed no later than August 24, 2026, and remained unsecured until September 28, 2026.
‎September 29
The Luna Moth Files were leaked after their last updated date, September 29, was likely secured on that same date.
‎October 3
A user named DonaldHame0q posted about the "Luna Moth Files" on X.com on October 3.
‎2026/10/11
The Luna Moth Files, a collection of leaked data, appeared on an onion site without explanation or claim of responsibility from Silent Ransom Group.
organisation The Luna Moth Files Weren’t Hacked
The Luna Moth Files Weren’t Hacked.
organisation Silent Ransom Group
Here’s How They Leaked.. When asked about the “Luna Moth Files” that had mysteriously appeared online, Silent Ransom Group called them “fake” and insisted they hadn’t had any leak or breach.
organisation DataBreaches
When the “Luna Moth Files” appeared on an onion site without anyone claiming responsibility or explaining their origin, DataBreaches asked a spokesperson for Silent Ransom Group (SRG) to comment on the leak.
organisation SRG
When the “Luna Moth Files” appeared on an onion site without anyone claiming responsibility or explaining their origin, DataBreaches asked a spokesperson for Silent Ransom Group (SRG) to comment on the leak.
Tactical Metrics
Metrics
data_breach
29
September
Did whoever secured the MongoDB instance on or about September 29  ever tell SRG’s top leadership that the instance was open for more than a month, or did someone try to cover up their mistake by not saying anything?
Intelligence Sources
Data Breaches 2026-10-11