silent ransom group2 articles
Blockchain Breadcrumbs Put Russian Extortion Crew's Leaked Chats Under the Microscope
Blockchain researchers at Chainalysis and Crystal Intelligence have partially verified leaked internal communications from Russian extortion group Silent Ransom Group (SRG), confirming that certain cryptocurrency wallet addresses in the material match known SRG ransom payments, including one funded entirely from a $10 million+ victim payment. The leaked "Luna Moth Files" allege SRG collected around $207 million from 27 law firms between April and September 2026, with the group converting cryptocurrency to cash through instant exchangers, a Moscow-based broker, and a sanctions-flagged exchange service. SRG's tactics include callback phishing and physical intrusions into law offices by recruited "field agents," with analysts noting that payments made directly to these agents via regulated exchanges represent the group's greatest vulnerability to law enforcement identification.
Fake IT Support Calls Are How This Gang Walks Into Law Firms and Walks Out With Everything
The Silent Ransom Group (also tracked as UNC3753/Luna Moth) is actively targeting U.S. law firms and professional services organisations using social engineering tactics, including fake IT support phone calls that trick employees into installing remote access tools, enabling data theft within hours. Once inside a network, attackers steal sensitive legal and financial documents before sending highly aggressive ransom demands — sometimes within 30 minutes of exiting the victim's environment — threatening to notify clients and regulators if payment is not made. Cybersecurity firm Mandiant and the FBI recommend organisations counter these attacks by enforcing strict IT verification procedures, limiting remote access tools, implementing multi-factor authentication, and training staff to recognise voice phishing attempts.