Silent Ransom chats allege law-firm infiltration; authenticity disputed

Leaked chats attributed to Silent Ransom Group describe recruiting people to enter U.S. law firms, while the group calls the dump fake.

Recorded Future News reviewed leaked chats from August 2025 to September 2026 that it attributes to the Russia-based extortion gang Silent Ransom Group, also tracked as Luna Moth and Chatty Spider. Members discussed recruiting U.S.-based operatives through Telegram job ads to enter law offices, sometimes posing as IT staff or delivery workers, and copy files to flash drives. Chainalysis linked cryptocurrency addresses in the archive to known Silent Ransom extortions, and an earlier FBI alert had warned the group was posing as IT personnel for physical access. The chats claim roughly $200 million from about 50 organizations, mostly law firms, but those figures and the most extreme kidnap and blackmail ideas were not independently verified. DataBreaches.net reported that an onion site called Luna Moth Files published the alleged chats and that Silent Ransom Group called the leak fake on Thursday, while researchers said the data appears authentic and the publisher remains unidentified. The sources agree the material concerns the same group but disagree on whether the dump is genuine.

• Silent Ransom Group, also tracked as Luna Moth and Chatty Spider, is tied to leaked chats reviewed by Recorded Future News covering August 2025 to September 2026.
• The chats describe recruiting U.S.-based operatives through Telegram job ads to enter law offices, sometimes posing as IT staff or delivery workers, and copy files to flash drives.
• Chainalysis linked cryptocurrency addresses in the archive to known Silent Ransom extortions, and an earlier FBI alert warned the group posed as IT personnel for physical access.
• The archive claims roughly $200 million from about 50 organizations, mostly law firms; those figures and unverified kidnap or blackmail ideas were not independently confirmed as carried out.
• An onion site called Luna Moth Files posted the alleged chats; Silent Ransom Group said Thursday the leak was fake, while researchers said the data appears authentic.
• The publisher of the dump remains unidentified, and DataBreaches.net reported no newly named victim organization.