Threat intel
Silent Ransom Group chat leak: what defenders should check
Leaked chats from the extortion crew that phones law firm staff as fake IT show how it works. The tools it uses, and what to block and look for.
Internal chats of the Silent Ransom Group (SRG), a Russia-based extortion crew also tracked as Luna Moth, Chatty Spider and UNC3753, appeared on an anonymous onion site in early October under the name "The Luna Moth Files". The export holds 5,692 messages, mostly in Russian, written between August 2025 and September 2026. A researcher told DataBreaches.net that the records sat in a misconfigured MongoDB database, which would mean they leaked rather than being stolen in a hack.
SRG does not encrypt anything. It phones staff while posing as their IT department, gets them to start a remote support session, copies data out and threatens to publish it. Most of its victims are US law firms, with insurance, finance and healthcare companies also hit. If your firm handles privileged or client data and lets staff install remote support software, this group is aimed at you.
How much of the leak is confirmed
Chainalysis checked cryptocurrency addresses in the chats against its own tracking. Some match addresses it already tied to SRG extortion, and one member's wallet named in the chats is funded entirely from a victim payment of more than $10 million that SRG collected in mid-2026. Chainalysis says it cannot "speak to the totality of claims" in the archive.
Crystal Intelligence traced the same wallets. The chats claim about $207 million from 27 firms that paid between April and September 2026, but Crystal could not verify that total, since none of the named wallets ever held a full ransom. It did follow the money upstream to a collection wallet that received about 2,675 bitcoin over its lifetime.
The chats track each victim through a sales-style pipeline with the stages "chat", "offer", "contract" and "gold", where gold means the victim paid. Check Point and S-RM both read the chats as a managed operation with separate people for target research, calling, hands-on work during the remote session, and negotiation. A firm that pushes back on one caller can expect another approach.
How an SRG intrusion works
Earlier SRG campaigns started with fake subscription renewal emails charging a small fee. To cancel, the victim called a number in the email, and the "support agent" sent a link that installed remote access software. From about April 2025, the FBI says, the group has often skipped the invoice and calls employees directly, posing as someone from their own IT department and asking them to open a remote session to fix a supposed problem.
Before calling, operators build contact lists of executives, IT leads and counsel from commercial people-data platforms. Check Point and S-RM both describe the same arc on the call: worry the target with a claim of suspicious activity, reassure them, then frame remote access as a security check.
Once connected, the FBI says SRG does very little privilege escalation. It goes straight to copying data, using WinSCP (a Windows file transfer client) or a hidden or renamed copy of Rclone, a command-line tool that syncs files to cloud storage. If the user is not a local administrator, the operators run the portable build of WinSCP, which needs no install. Because every tool is legitimate, antivirus rarely flags any of it, and the FBI notes that recent campaigns leave few artifacts.
When phone and email do not work, the group sends a person. The FBI warned in May 2025, and again in a May 26, 2026 flash alert, that someone posing as IT support may turn up at the office, say they need to back up or image a machine, and plug in a storage device. The leaked chats show how those people were found: Russian-language job ads for "nightclub promoters" in US cities paying $300 or more a night, with respondents steered into office visits. Many recruits took the money and dropped out.
Extortion follows by email and phone. SRG calls employees and sometimes clients of the victim to push for negotiation, and it has a leak site that it uses inconsistently.
What else the chats discuss
The archive includes plans to follow senior lawyers, to blackmail or kidnap executives, and to approach a senior employee at a US military contractor. One channel discussed recruiting US sailors near naval bases to get information on submarine-based nuclear forces. The Record, Crystal and S-RM all found no evidence that these plans were carried out, and S-RM calls the espionage ideas aspirational. By September 2026 members were discussing a relaunch under a new name, Sleepless Threat, so expect the same methods under another brand.
What to check and block
Start with the remote access tools, since every stage of the intrusion runs through them.
- List what is allowed. Pick the one remote support tool your help desk uses and block the others with AppLocker or Windows Defender Application Control rules by publisher. The FBI names Zoho Assist, Syncro, AnyDesk, Splashtop and Atera as tools SRG has used; block their installers and portable versions on any machine that should not run them.
- Hunt for what is already there. Query your endpoint tool or software inventory for those five products installed or run in the last 90 days, and confirm each with its user. A tool that appeared the same day a user took an "IT" call is the pattern to look for.
- Look for the exfiltration tools. Alert on WinSCP or Rclone connecting to an external IP address, which the FBI lists as an indicator. A renamed Rclone still uses its own flags, so search process command lines for
--transfers,--configorrclone.confregardless of the file name, and look for WinSCP.exe running from Downloads or a temp folder. - Watch outbound volume. Flag large uploads from a single workstation to cloud storage, especially personal accounts, in the hour after a new remote session starts.
- Lock down USB storage on machines holding case files, through Group Policy or your endpoint tool's device control, so a visitor with a drive gets nothing.
Then fix the human process the calls exploit:
- Write down how IT will contact staff and how staff can verify it. The rule S-RM and Check Point both give is to hang up and call back on a known internal number before granting any remote session.
- Brief reception and facilities that nobody gets to a desk on the strength of saying they are from IT. Check names against a list the IT team keeps, and escort visitors.
- Tell executives, counsel and their assistants that people in their roles are on the group's call lists. Give them a set escalation path to your incident response contact for any extortion call.
- Run your incident response exercise against data theft with no encryption, since there will be no locked files to tell you it has happened.
If you think you were a past victim, the leak may contain your firm's name and details of your negotiation. S-RM suggests reviewing it, or having a specialist do so, and watching dark web sources for your data. The FBI asks victims to share ransom notes, the phone numbers used, call recordings and wallet addresses with their local field office.
The wider lesson
The FBI points out that SRG leaves few artifacts and that antivirus is unlikely to flag its tools. Detection therefore depends on knowing what normal looks like: which remote tool is approved, who installed anything else, and how much data a workstation usually sends out. Those baselines still apply when the crew relaunches under a new name.
Our safeguarding and hardening work sets up remote tool allow-lists and USB control, and our security operations team watches for the session-then-upload pattern described above. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.
Sources: Risky Bulletin, 12 October 2026, The Record, Crystal Intelligence, Chainalysis, The Register, DataBreaches.net, S-RM, Check Point, FBI PIN 20250523-001, FBI flash alert, May 2026, Help Net Security.