A leaked cache of internal chat logs shows a phone-based extortion crew squeezed roughly $207 million out of 27 U.S. law firms over six months, without ever deploying ransomware or encrypting a single file.
The figures come from a leak shared with the breach-tracking site DataBreaches: about 5,692 chat messages pulled from two servers belonging to Silent Ransom Group, covering activity from August 2025 through September 2026. According to the group's own internal deal board, victims paid out between April 3 and Sept. 24, 2026, with a median payment of $6 million. The largest single payment, roughly $30 million from White & Case, reportedly grew to about $31.25 million in bitcoin terms as the cryptocurrency's price rose before the funds were converted. Outside researchers at Crystal Intelligence say on-chain transaction data supports the overall scale of the scheme, though not every individual figure in the chats.
How the law firms were hit
Silent Ransom Group's method relies on telephone calls rather than malware. The FBI warned law firms in a May flash alert that the group's operators pose as a victim's own IT staff and talk an employee through granting remote access to their desktop; if that fails, the group has sent people in person to plug a storage device directly into a victim's computer. A typical attack begins with a bland, invoice-themed email carrying no malicious payload at all — its only purpose is to set up the follow-up phone call that does the actual damage. DataBreaches matched nine of the 27 named victims to breach notices law firms had already filed this year; Blank Rome reported in May that an attacker posing as internal IT talked an attorney into uploading files to an external Google Drive, while Goodwin Procter said a single employee was deceived into handing over login credentials.
A denial, then more evidence
Silent Ransom Group initially agreed to be interviewed about the leak and denied that its own systems had been breached. DataBreaches published additional evidence on Oct. 9 challenging that denial, and the dispute remains unresolved. The chats also show inconsistencies on the group's own side: a roughly $4 million offer from Hogan Lovells appears in the messages with no record that the full amount was ever paid, and an approximately $6 million offer attributed to Sheppard appears on the group's leak site despite no visible response from the firm in the chat logs.
Silent Ransom Group is also tracked under the names Luna Moth, Chatty Spider and UNC3753. Researchers say it split off from the Conti ransomware syndicate after that group's 2022 collapse and had previously run BazarCall campaigns that gave Conti and Ryuk operators their initial access into corporate networks, a history detailed by BleepingComputer's reporting on the FBI's warnings. It has focused on U.S. law firms since 2023, drawn by the sensitive client data firms hold and, investigators say, a greater willingness among some partners to pay quietly rather than disclose a breach. The FBI urges firms to train staff to treat unexpected IT phone calls with the same suspicion as phishing emails and verify remote-access requests through a separate channel. With the leak's authenticity still contested, researchers say the bigger test will be whether the named firms confirm, in their own filings, what they actually paid.
