Silent Ransom Group Chat Leak Analyzed: A Reason for Sleepless Nights

In October 2026, an archive of internal chats attributed to the Silent Ransom Group (SRG), also tracked as Luna Moth, was publicly reported on October 7. It holds 5,692 Rocket.Chat messages spanning August 2025 to September 2026, along with a vishing script, a purported IT employee CV and a naval-base research spreadsheet. KELA’s Cyber Intelligence Center analyzed the material. The archive’s authenticity remains unverified, but it gives a rare look at how a data-theft extortion crew prepares its attacks, runs its negotiations and plans its next moves.

You can download the full report here.

Why groups like SRG persist, and why they are dangerous

SRG has been active since at least 2022, according to the FBI. Its model is simple: steal data, then threaten to publish it, usually without encrypting anything. It relies on people and legitimate tools rather than malware. The attack starts with a phone call. Callers pose as internal help-desk or security staff and persuade employees to join a Zoom, Teams or Quick Assist session. They then use legitimate remote administration software to move files to attacker-controlled storage, with WinSCP and Rclone among the documented tools. When remote access fails, the FBI has described individuals posing as IT staff who walk into offices and copy files to removable storage.

Excerpt from the vishing script in the alleged SRG leak, written as a call from the internal IT department. The group also adapts. It began with callback phishing and moved to help-desk impersonation. The leaked chats show plans to recruit US-based agents for physical access and to place operatives through fabricated CVs. In September 2026, participants on a separate server coordinated a possible SRG-linked extortion operation under a new name, Sleepless Threat, and one proposed it as a way to distance the operation from SRG. The harm goes beyond the stolen files. Law firms hold confidential client documents, privileged correspondence and commercially sensitive records.

Are US organizations more of a target?

For this group, the evidence supports this. The FBI reports that SRG has consistently targeted US-based law firms since spring 2023. Mandiant identified a campaign from January to May 2026 against dozens of US organizations in professional, legal and financial services. The leaked chats point the same way: they show a primary focus on US-based organizations, particularly law firms, and discussion of buying access to US companies to build the Sleepless Threat brand.

A message from the user “Henry” in the alleged SRG leak, March 19, 2026, describing the goal of entering a law firm to access a computer.

The interest goes beyond business. A spreadsheet in the leak lists 13 naval installations, nine of them in the United States or Guam, with nearby businesses and social venues. One participant proposed approaching US military personnel there for information on submarine-based nuclear forces.

US law firms are the clearest target, but not the only one. The FBI also lists victims in the insurance, finance and healthcare sectors.

What the leaked chats reveal

KELA’s analysis of the archive points to three findings:

• Structured extortion operations: According to the leaked communications, SRG employed organized social engineering and victim negotiation processes. Analysis of the leaked chats indicates approximately USD 207 million in claimed settlements, which remain independently unverified.
• Physical infiltration plans: The leaked communications indicate a primary focus on US-based organizations, particularly law firms, across both extortion activities and alleged plans to recruit operatives for physical or insider access. Successful execution remains unverified.
• Expansion into intelligence gathering: The leaked communications document plans to recruit US military personnel and collect sensitive defense-related intelligence, suggesting ambitions beyond financially motivated extortion. Successful execution remains unverified.

The report also lists 62 unique Bitcoin addresses shared between alleged group members, with first-observed dates. Separate blockchain research found that wallets referenced in the chats received approximately 37 BTC (around USD 3 million), though that does not confirm the group’s claimed totals.

KELA users can explore the leaked chats and pivot from the report’s indicators on the platform.

Building ransomware and extortion defense with cyber threat intelligence

Start with the basics the report recommends: strict verification for IT support requests, restrictions on unauthorized remote management tools, stronger physical site security and monitoring for anomalous data transfers.

Those controls protect your own environment. Cyber threat intelligence shows what is being prepared outside it. SRG’s operation took shape in chat rooms where operators shared call scripts, tracked negotiations and discussed buying access to US companies.

With KELA, security teams can:

• Search the cybercrime underground for their own organization. KELA’s Investigate module searches hacking forums, instant-messaging channels and other underground sources by domain, email address or keyword. Saved queries send email alerts when new results appear.
• Watch the access market. Remote access to breached servers, and credentials taken from infostealer logs, are offered for sale in cybercrime markets. Investigate covers both through its Breached Servers and Compromised Accounts data.
• Investigate the actors directly. With the leaked SRG archive on the KELA platform, analysts can search the chats themselves for handles, domains and Bitcoin addresses.

The aim is to see the preparation, not just the outcome.

What’s in the full report

• The roles of the main chat members, from the negotiation lead to technical infrastructure and support
• How the CHAT, OFFER, CONTRACT and GOLD labels track each extortion negotiation
• The groundwork laid before the first call: a legal-services-themed domain, business email accounts and telephony servers
• The full Sleepless Threat section, including alleged extortion demands sent under the new name
• All 62 Bitcoin addresses shared between alleged group members, with first-observed dates, here's a sample:
  • Sep 24, 2026 bc1q48judrx0k82cwdtw3wm2glslf0s9e3wq90qag7
  • Sep 24, 2026 bc1qv94tw4mpcpp8nhy6wceyazkwa5lsaa2ujzddch
  • Sep 24, 2026 bc1q8tnmj2wtthsva0fnzyvl6vdv6kcsud354tkwlr
  • Sep 25, 2026 bc1qxtauswsz937ydc0smrj4lsjsnuhkzthc60ah7y
  • Sep 28, 2026 bc1q5lfuz8fmetfpcckxf6kmms4kp6xzraazy4gguy





Read the full report here