Summary
- An anonymous leak claims to expose Silent Ransom Group's internal records and working methods.
- The archive's 50 most recent listed victims include 42 law firms, according to Check Point's analysis.
- Researchers caution that the material is unverified, incomplete and internally inconsistent.
A leaked archive attributed to the Silent Ransom Group portrays a telephone-led data extortion operation organised around specialist roles, victim management and commercial negotiation, according to a new analysis by Check Point.
Published on 9 October 2026, the research examines files posted around 5 October on an anonymous onion site under the name The Luna Moth Files. The material purports to contain group communications, a caller playbook, screenshots, victim-management records and a purported fake employee résumé. Check Point does not know who published the archive or how it was obtained.
The provenance matters. Check Point warns that the collection is unverified and contains internal inconsistencies. Some broad descriptions of the group’s activity align with FBI warnings and earlier public reporting, but assertions found only in the leak should not be treated as independently confirmed operations or payments.
Silent Ransom Group, also tracked as Luna Moth and UNC3753, has been associated with data extortion operations relying on social engineering rather than conventional ransomware encryption. The group seeks access, obtains sensitive information and uses the threat of disclosure to pressure victims into paying. Its reliance on persuasion and stolen data shapes the division of labour depicted in the archive.
Check Point describes separate functions resembling customer acquisition, operations and account management. Individuals are portrayed as researching targets, conducting calls, managing access, moving files and pursuing negotiations. Telephone conversations can serve as a control channel, with callers steering victims or personnel through actions that would otherwise be difficult to achieve through malware alone.
Law firms figure prominently in the leaked records. According to the researchers, 42 of the 50 most recently listed victims were legal practices, and the accompanying material expressed interest in top-100 law firms. These are figures from an unverified internal list, not a confirmed count of successful breaches or independently identified victim organisations.
The apparent concentration on law firms is nevertheless consistent with the group’s known extortion model. Legal practices can hold commercially sensitive information for clients, including litigation material, transactions, disputes and confidential correspondence. Those holdings may create pressure even when attackers cannot encrypt a firm’s systems or interrupt its day-to-day operations.
Records in the archive reportedly used labels including CHAT, OFFER, CONTRACT and GOLD to distinguish stages or categories within a victim pipeline. Such terminology suggests a process for managing contacts and negotiations, but the meaning of every label cannot be established definitively from the leaked records alone.
The collection also refers to Fake_Employee and possible in-person access methods. These references require particular caution: an internal document describing a technique is not proof that the technique was deployed against a named victim. The report offers a window into what operators may have discussed or planned, rather than independent verification of each incident.
The absence of a novel exploit or ransomware payload is part of the story. The alleged operation depended on organisational processes, pretexts and human interaction to move from initial contact to access and extortion. Such campaigns can evade security approaches that focus exclusively on malicious attachments or recognisable malware.
Requests for access, software installation or data transfers may appear to follow routine processes even when the caller is impersonating an authorised employee or supplier. The aim is to interrupt social manipulation before it reaches privileged systems or sensitive client records.
Check Point’s account should be read as a structured assessment of potentially revealing but unverified material. Its strongest claims are those supported by independent FBI or prior research; the leaked chats, payments and operating labels remain subject to questions about authenticity, completeness and context.
