Leaked Chats Reveal Silent Ransom Group’s Plans to Infiltrate U.S. Law Firms
Summary
Leaked chats linked in part to the Silent Ransom Group describe plans to infiltrate U.S. law firms and recruit operatives. Some tactics match an FBI warning, but the archive does not verify that its most extreme plans were carried out.
Key points
- An archive of thousands of messages from August 2025 to September 2026 describes the gang’s extortion activity and plans.
- Chainalysis linked cryptocurrency addresses in the archive to known Silent Ransom Group extortions, but cautioned it could not verify all claims.
- The FBI has warned that group members pose as IT personnel to gain physical access to victims’ computers.
- The chats describe recruiting Russian-speaking operatives through paid Telegram job ads and using office-entry ruses, forged identification and recording devices.
- The archive lists about 50 organizations, mostly law firms, and roughly $200 million in claimed settlements; those figures were not independently verified.
- The chats include proposals for kidnapping, blackmail and targeting military personnel, but the article found no evidence these plans were carried out or that military information was obtained.
- The group discussed relaunching under the name Sleepless Threat.
Article Details
- Event Type
- Leaked chats reveal a cyberextortion group’s reported operations and unverified plans involving physical infiltration of law firms, coercion, and recruitment of U.S. military personnel.
- Impact
- The archive records roughly $200 million in claimed settlements, which could not be independently verified. A law firm reportedly said an individual entered its New York office and copied files. The article says there is no evidence that the most extreme schemes were carried out or that military personnel were recruited or military information obtained.
Threat Actors
Chatty SpiderName under which the Silent Ransom Group is also tracked, according to the article.LockBitRansomware gang cited in a law-firm negotiation; the firm said it had evidence that LockBit failed to delete data belonging to victims who paid.Luna MothName under which the Silent Ransom Group is also tracked, according to the article.Silent Ransom GroupCyberextortion group linked by Chainalysis to known extortions; the FBI has documented its use of impostors to gain physical access to victims’ offices.
Countries
RussiaMembers of a Russia-based cyberextortion gang plotted to send operatives into U.S. law firms, kidnap business executives and even recruit military personnel to spy on submarine-based nuclear forces, according to leakedUnited Statestrack dozens of victims, haggle over multimillion-dollar payments and direct operatives based in the United States whom they call “agents.” Some of the named organizations have not publicly acknowledged a breach.
Industries
DefenseAnother user replied that the money could come from the Russian Ministry of Defense, although it is unclear whether the suggestion was sincere. The user ended the message with a laughing emoticon before saying he wasLegalextradition risks, such as Ethiopia, while bemoaning the exposure of jurisdictions such as Dubai to U.S. legal interdictions.