UPDATED 2:42 pm October 8: Plot twist! Silent Ransom Group agreed to be interviewed about the Luna Moth Files but denies that the group has been breached or leaked. More to follow later.
DataBreaches has reported extensively on Silent Ransom Group in 2026, often including material provided exclusively to this site by the group. Now, what appears to be a leak of their internal chats may shed additional light on their success.
DataBreaches has reported on Silent Ransom Group (SRG) since 2022, with particular interest in their numerous attacks on law firms. Those interested in the group should review our past coverage, which often includes exclusive material and details.
Do you remember the Conti leaks in 2022 that were variously ascribed to either a Ukrainian researcher or a disgruntled member of Conti? Well, now Conti’s offspring, Silent Ransom Group, has experienced a leak, too, although we do not yet know to whom to ascribe it. This new leak includes material from two servers during the period August 27, 2025 – September 29, 2026 (slplsskdj2836v2jjsx.com and aim6umein3kee.com).
The leak was first shared with this site by Tammy Harper as an onion site with 5,692 chat messages that discuss victim payments, possible access methods, approaches to future victims, the purchase of an apartment in Moscow by one of the members, and discussions of guns and drones, among other topics.
Analysis of payments and money laundering
Crystal Intelligence has published an analysis of payments and money movement. The key points of their report:
- The chat points to Silent Ransom Group (SRG), also tracked as Luna Moth. SRG is a Conti offshoot that extorts law firms through phone-based social engineering and, more recently, in-person office visits.
- The group’s internal deal board claims about $207M paid by 27 firms between April 3 and September 24, 2026. On-chain evidence supports the scale but not the exact figures.
- Payouts followed strict wallet rules designed to defeat tracing. The operators didn’t always follow them.
- Cash-out ran through instant exchangers, a Moscow cash courier, a Bitcoin-to-Zelle desk, and a coin-mixing wallet when funds were flagged.
- Many smaller payments went straight to regulated exchanges, where accounts are tied to verified identities. This is the network’s weakest point.
Their analysis and commentary are fascinating, as is reading the chats themselves. In this post, we focus on the amounts paid or offered by victims, as reported in the leaked chats.
Silent Ransom Group (SRG) reported payments as “GOLD” for 27 named targets in the leaked material. The table below reports the alleged victims and the amounts reportedly paid. Nine of the 27 victims who allegedly paid between April 1 and September 29, 2026, have reported breaches in 2026 that correspond in time to the dates of material in the leak. While some victims describe social engineering attacks consistent with SRG in their notification letters, we have no actual confirmation from victims that (1) SRG carried out the attacks and (2) that they paid or offered the amount listed in the chat material or mentioned on SRG’s dedicated leak site.
NOTE: The chat material also referenced other victims by name who did not pay during the time period of the leaked material and are not listed in the chart.
[table id=1 /]
Statistical analysis of the 27 entries indicates that the median payment was $6 million, while the arithmetic mean payment was $7.664.814.81, skewed positively by a few very high payments. The lowest alleged payment during this period was $100,000.00. The highest payment was $30 million by White & Case, leading member “Adrian” to exuberantly claim,
“РЕКОРДНЫЙ ГОЛД БРАТ! ДАВАЙ КОШИК
НО ИЗ-ЗА РОСТА КУРСА BTC В ИТОГЕ 31.250.000”(“RECORD GOLD BROTHER! COME ON KOSHIK, BUT DUE TO THE GROWTH OF THE BTC EXCHANGE RATE, IT ENDED UP AT 31.2500.000“)
The total amount of “GOLD” reportedly paid during the 6-month period was $206,950,000.00.
The leak also revealed that on May 1, “Adrian” reported one victim’s initial offer of $12 million was the biggest initial offer they had ever received, and the victim made it only 7 hours after starting the chat. The victim was reported to have ultimately paid $19,000,000.
We repeat that the listed victims have not confirmed any of these payments, although 9 of the 27 did disclose breaches relevant to the time period in question.
Leaked chat provides some support for claims
The leak gave us the opportunity to try to verify claims SRG made to us about their attack on Hogan Lovells Cadwalader. Checking mentions of “hlc.com” and “Hogan Lovells Cadwalader” in the leaked chats yielded the following:
- The name and email address SRG used in their chat with HLC matched the ones they provided to DataBreaches in unredacted chat logs.
- On September 2, the leak chat log notes an offer from HLC for $4,ooo,ooo. Screenshots of the actual chat log for that day, provided to DataBreaches by SRG, match the date and amount.
DataBreaches did not find any notes for HLC more recent than the September 2 entry, but there was no entry for “GOLD” for them, and it therefore seems likely that SRG did reject an offer from them of at least $4 million. It’s possible the rejected amount was actually the $5.34 million amount SRG claims they rejected, but there was no final entry for this victim. Nor was there one for Cozen O’Connor, where the chat leak shows an offer that wasn’t accepted, but there was no proof that they had ever offered $5.8 million, which is what SRG claims on its leak site.
We also saw alleged offers from other victims, including Farella Braun & Martel and Barclay Damon. According to the chat leak, both firms made offers, yet, like Cozen, they wound up on SRG’s leak site with notes that they had offered amounts that were unacceptable. The amounts listed on the leak site were higher than what we could document from the leak, however.
Other firm names appear with offer amounts, but no follow-up could be found, other than checking to determine if such firms had shown up on SRG’s dedicated leak site. Some firms may still be in negotiations with SRG.
Sheppard was one of the law firms that appeared in the leak material, but there was no indication that they ever responded to SRG or made any offer. Yet their name appears on the leak site with a note that they had offered almost $6M.
For now, it seems that the chat leak offers at least partial significant support for claims made by SRG on their leak site.
The leak also offers a lot of other information and material that can be of help to investigators and law enforcement.
DataBreaches has reached out to SRG to ask if they’ll agree to answer some questions about the alleged chat leak. We will update this post if we receive a reply.
Update 6:54 pm ET: Translation of Adrian’s comment corrected.