Thousands of leaked internal messages from the Russian extortion crew Silent Ransom Group show it recruiting people in the U.S. to enter law firm offices posing as IT workers and walk out with data on flash drives, The Record reported Thursday. The archive, posted to a custom .onion site in early October by an unknown party, covers August 2025 to September 2026.

What Happened

The group, also tracked as Luna Moth and Chatty Spider, found its recruits through Telegram ads dressed up as ordinary jobs, including nightclub promotion, courier work and security, according to The Record's review of the chats. A roster sorted operatives by city using numbered codes, and at least one entry referred to a 17-year-old.

Members discussed disguises such as pizza delivery uniforms, custom masks modeled on real lawyers and smart glasses to record office layouts. They bought a $3,200 printer capable of ultraviolet printing, along with holographic material for fake identification, and dealt with document forgers, including one in New York. In February, the group's leader estimated that only about one in 10 recruits followed through; some took payments and vanished, while others turned back at office entrances.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

About 50 organizations appear in the records, most of them law firms. Several have publicly disclosed breaches, but many have not. In one negotiation, a New York law firm acknowledged that someone had entered its offices and copied files onto a flash drive.

Negotiations ran into the millions. In one, an opening offer of $100,000 was mocked in the chats as "missing a zero." Later entries climbed through amounts from $500,000 to $3.5 million before the records listed a $6 million deal. Across dozens of firms marked "gold," the archive tallies about $200 million in claimed settlements, a figure that could not be independently verified.

Why It Matters

Silent Ransom Group built its reputation on callback phishing, persuading employees by phone to install remote-access tools and then stealing data without deploying encryption. Sending people physically into offices removes the need to trick anyone over the phone and bypasses many network defenses, since a visitor with a flash drive can reach data an outside attacker cannot.

Law firms are an attractive target because they hold confidential client material and face professional pressure to keep incidents quiet. The leak suggests some victims named in the chats have never told clients or the public what happened.

Chainalysis reviewed cryptocurrency addresses in the archive and confirmed links to known Silent Ransom Group extortions, while saying it could not vouch for every claim. Earlier this year, the FBI issued a flash alert warning that members of the group were posing as IT staff to gain access to victims' computers.

Unverified Schemes

The chats also include brainstorming that does not appear to have gone anywhere. In April, members discussed targeting an employee of a military contractor, and a channel created in May focused on recruiting U.S. sailors near naval bases. The Record found no evidence that any recruitment succeeded. Talk of kidnapping executives and blackmail plots likewise showed no sign of being carried out, and a suggestion that Russian Defense Ministry money might fund operations ended with a laughing emoticon. The final messages, from September, discussed rebranding as "Sleepless Threat."

What to Watch

Law firms named in the archive may face pressure to disclose incidents they have kept private. Investigators can use the recruiting chats, city codes and forger contacts to identify U.S.-based operatives, and other organizations may want to tighten visitor checks for unscheduled IT visits.