Silent Ransom Allegedly Extorted About $207 Million

Leaked chats claim Silent Ransom Group took about $207 million from 27 mostly law-firm victims without encrypting data; the total is unverified and some names are disputed.

DataBreaches reported on Oct. 7, 2026, that Silent Ransom Group appeared to have made more than $200 million in six months by extorting victims without encrypting systems, citing an apparent internal-chat leak and naming no victims. Later coverage of 5,692 messages from August 2025 to September 2026 says ‘GOLD’-marked completed deals total $206.95 million from 27 victims, with Crystal Intelligence placing payments between April 3 and September 24, 2026 (median $6 million; range $100,000 to $30 million), including $30 million attributed to White & Case; the group denies the leak and the headline total is unverified. Accounts disagree on composition: one describes 27 mostly law-firm victims, naming Dentons, Squire Patton Boggs, and WilmerHale, while a later report says the chats claim 27 law firms paid roughly $207 million. The group, also tracked as Luna Moth and UNC3753 and active after Conti’s 2022 shutdown, is described as impersonating IT support by phone, obtaining remote access or credentials, having staff upload files to Google Drive, exfiltrating data with WinSCP and Rclone, and threatening publication rather than using encryption. Crystal Intelligence says blockchain data supports the scale but not exact figures and traced about 344 BTC (about $27 million) to one wallet; reported cash-outs involved fresh wallets, exchangers, couriers including a Moscow courier, Zelle or Bitcoin-to-Zelle, and coin mixers. Blank Rome and Goodwin Procter confirmed social-engineering incidents with no malware, while payment claims involving Hogan Lovells and Sheppard remain disputed or unconfirmed.

• Silent Ransom Group (also Luna Moth and UNC3753) is alleged to have extorted victims without encrypting systems; it emerged after Conti’s 2022 shutdown, and DataBreaches has covered it since 2022.
• A leak of 5,692 internal messages spanning August 2025 to September 2026 shows ‘GOLD’-marked deals totaling $206.95 million from 27 victims; other accounts round this to about $207 million or more than $200 million.
• Crystal Intelligence dated payments from April 3 to September 24, 2026 (median $6 million; range $100,000–$30 million), including $30 million attributed to White & Case, and traced about 344 BTC (~$27 million) to one upstream wallet.
• Sources disagree on victims: one says 27 firms, mostly law firms (including Dentons, Squire Patton Boggs, and WilmerHale); another says 27 law firms. Hogan Lovells and Sheppard payment claims are disputed or unconfirmed.
• Reported tactics are fake IT-support calls, remote access or credential and Google Drive handoffs, exfiltration with WinSCP and Rclone, and publication threats rather than encryption; the group denies the leak.
• Blank Rome and Goodwin Procter confirmed social-engineering incidents with no malware. Crystal Intelligence says on-chain data supports the scale, not the exact totals.
• Reported cash-outs used fresh wallets, exchangers, couriers including a Moscow courier, Zelle or a Bitcoin-to-Zelle service, and coin mixers.