Silent Ransom Group chat leak: $207m claimed from law firms

On 6 October 2026 an onion site titled “The Luna Moth Files” appeared with what it presents as the internal chats of Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider and UNC3753 — the extortion crew the FBI says has consistently targeted US law firms since spring 2023. DataBreaches.net reports that the material comes from two servers and runs from August 2025 to 29 September 2026: 5,692 messages about victim payments, ways in and future targets. Who leaked it, and how, is unknown.

What the chats claim

The chats track each victim through stages; the last, “GOLD”, means paid. According to Crystal Intelligence’s analysis, the group’s internal deal board marks 27 law firms as paid between 3 April and 24 September 2026, about $207m in total. DataBreaches puts the median payment at $6m and the range at $100,000 to $30m.

These are the group’s own figures. Crystal says on-chain evidence “supports the scale but not the exact figures”. Chainalysis, as reported by Reuters, said some leaked addresses were ones it already tracked, including one that reflected a $10m victim payment SRG collected in mid-2026. Reuters said it could not immediately verify the site’s claims.

Nine of the 27 firms disclosed breaches in 2026 on dates that match the chats. But, as DataBreaches stresses, no law firm has ever confirmed or denied paying SRG, and we are not naming the firms listed. The group told DataBreaches on 8 October that “SRG was never leaked”. DataBreaches found details that point the other way: an email account named in the chats was still live, a Telegram account mentioned in them was active, and the domains existed at the time.

Why it matters

If even the scale is right, it shows how well a low-tech attack pays. SRG uses no ransomware. The FBI’s May 2026 FLASH alert describes the playbook: a caller posing as the firm’s IT department talks an employee into a remote session with a legitimate tool such as Zoho Assist, Quick Assist or AnyDesk, and files go to Google Drive, OneDrive or an external server. If the call fails, a fake technician turns up at the office to plug in a USB drive. Mandiant saw data searched, staged and stolen in under an hour, an extortion email often within 30 minutes, and a three-day deadline. Antivirus, the FBI notes, is unlikely to flag any of it, because the group uses legitimate tools.

Counsel’s note

Ihor Makushinsky · senior counsel

The leak carries two lessons beyond the numbers. First, paying does not buy confidentiality. If the ledger is genuine, the firms it lists are now named, with amounts, in material anyone can read — exposed not by the group but from its own servers. Second, the pressure runs through clients: the FBI says SRG calls a victim’s clients to push it into negotiating. Under ABA Formal Opinion 483, a breach that involves, or is substantially likely to involve, material client information triggers a duty to notify current clients. They should hear it from the firm first.

The fix the FBI points to is procedural: “Develop and communicate policies regarding when and how IT support will communicate and authenticate themselves to employees.” Mandiant applies the same logic to visits: check every technician against a pre-scheduled work order. A policy works only if an associate can check the caller while they wait. That check is what Lawyerd for Law Firms is built around: before anyone from IT calls, the employee gets a Teams message with the technician’s name, the ticket and a code. No code, no screen share.