KELA-BERICHT
The Silent Ransom Group (SRG) Internal Chats Leak Analysis
KELA analyzed 5,692 messages from the alleged Silent Ransom Group (SRG) leak, published as the Luna Moth Files, to map its roles, vishing tradecraft, extortion pipeline and parallel Sleepless Threat operation.
Teilen:
In October 2026, an archive presented as the internal communications of Silent Ransom Group (SRG), also tracked as Luna Moth and UNC3753, was released publicly as “The Luna Moth Files.” KELA analyzed 5,692 Russian-language Rocket.Chat messages across two servers, spanning August 2025 to September 2026, together with a vishing script, a purported IT technician CV, a naval-base research spreadsheet and five screenshots.
The archive’s authenticity and completeness remain unverified, and the report flags where the chats record claims rather than confirmed events.
SRG, active since at least 2022, runs data-theft extortion focused on US organizations, especially law firms and professional services. The report maps how the group organized that work and lists the 62 Bitcoin addresses identified in the chats, with their first observed dates. The archive is available in the KELA platform.
Short on time? Read or listen to our summary of the leak on the KELA blog.
Wichtigste Erkenntnisse des Berichts:
- In September 2026, participants coordinated a separate extortion operation under the name Sleepless Threat, with one member proposing the new identity to distance the activity from SRG.
- The chats track victim negotiations through four internal stages, CHAT, OFFER, CONTRACT and GOLD, with 27 organizations marked GOLD and stated amounts of about USD 207 million in alleged settlements. The label does not confirm payment.
- A recovered Russian-language vishing script coaches callers to claim suspicious activity on an employee’s device and present a remote session as a necessary security check.
- Members discussed recruiting US-based agents to enter law firms posing as IT staff or contractors, and placing operatives inside companies through job applications backed by fabricated CVs.
- A spreadsheet in the leak lists 13 naval installations and nearby social venues, and the chats propose approaching US military personnel there for information on submarine-based nuclear forces.
