Leaked Chats Show Silent Ransom Group Squeezing Law Firms by Phone

Leaked internal files from Silent Ransom Group, the callback-phishing extortion crew also known as Luna Moth, show it squeezing mostly US law firms with phone calls and remote-access sessions, no malware required. Ransom-ISAC analyzed the material, which includes 5,692 chat messages from August 2025 to September 2026, and judges it most likely authentic. The files surfaced on Oct. 3; who leaked them isn’t known.

aim6umein3kee[.]com
slplsskdj2836v2jjsx[.]com
sokolovsky-law[.]com
87.251.67[.]222
87.251.67[.]223

Source article: Silent Ransom Group – Leak Analysis
Publisher: Ransom-ISAC Research Team (contributors Ellis Stannard, Jon DiMaggio, M. Smith, Manny W, Nick Smart, Nikolai Kichatov, Rakesh Krishnan, Tammy Harper, Valéry Rieß-Marchive)
Published: Oct. 26, 2026
URL: https://ransom-isac.org/blog/silent-ransom-group-leak-analysis/

Executive Summary

Silent Ransom Group (SRG), also tracked as Luna Moth and publicly described as a “callback phishing” crew, rebranded in September 2026 as Sleepless Threat; Ransom-ISAC rates the Luna Moth lineage as probable and notes the newest activity may come from a splinter group. The analysis rests on four files leaked on Oct. 3, 2026, including 5,692 chat messages from August 2025 to September 2026, which Ransom-ISAC judges most likely authentic. The campaign is a data-theft extortion operation with no malware, C2 framework or encryptor: operators research a firm and its staff, call them from a 3CX PBX while posing as IT or a vendor (sometimes after an email or PDF urging the victim to call), talk the victim into opening an AnyDesk (or RDP, Zoho Assist) session, copy files out by hand to consumer cloud storage such as Google Drive and Yandex Disk, then send an extortion email with sample data and a short deadline and move negotiations to ProtonMail and SimpleX Chat. About 33 firms are named as targets, roughly 88% of them US law firms, the rest accounting, insurance and healthcare businesses in the US and UK; a mass vishing push hit 15 or more firms on Aug. 26, 2026. The group’s own books confirm at least $43.95 million received from 27 paying firms (Ransom-ISAC calls a $206.95 million total probable). Plans for insider placement, physical access and targeting of military personnel appear in the chats but are graded possible or claimed, not confirmed. Hunt leads, false-positive expectations, the absence of published rules, and the indicators are detailed below.

ATT&CK chain: Reconnaissance → Resource Development → Initial Access → Execution → Collection → Exfiltration → Impact

Hunt Lead Grid

SRG PBX, Chat Server and Cover-Domain Sweep

The leak exposes the infrastructure behind the calls and coordination: two 3CX PBX servers hosted in the Netherlands at 87.251.67[.]222 and 87.251.67[.]223 (online since Sept. 5, 2025), the primary Rocket.Chat server at aim6umein3kee[.]com (5,458 of the leaked messages), a secondary Sleepless Threat server at slplsskdj2836v2jjsx[.]com, and a fake law-firm domain, sokolovsky-law[.]com, built by an operator to pose as a counterparty. Rebrand domains the group considered, sleepless[.]co, sleeplessthreat[.]com and threatactorsneversleep[.]com, are listed as candidates rather than confirmed in use. The detection logic is a retrospective sweep of SIP and VoIP call records, firewall and NetFlow logs, DNS resolver logs, web proxy logs and email gateway logs for any of these addresses and domains, plus a mailbox search for messages from or mentioning sokolovsky-law[.]com and for the cover identity juandiego20995[at]gmail[.]com used on a fake job application.

Use the phone system’s call detail records (many cloud and on-premises PBXs log the caller’s SIP source address as well as the number), perimeter firewall logs, DNS and proxy logs from all workstations, and the email gateway’s message trace. Sweep at least 13 months, back to September 2025, since the PBX addresses have been in use that long. Scope to everyone, then prioritize hits on lawyers, paralegals, assistants, finance staff and the front desk, who take these calls first. A hit on the PBX addresses shows contact, not compromise; pair it with the remote-access lead to see whether a session followed. Blocking the IP addresses is worthwhile but should not be the only control, because the group can stand up new PBX hosts and change caller ID in minutes; the durable signal is the behavior covered in the later leads. Any contact from these hosts should be reported to the targeted user and to leadership, since SRG often calls several people at the same firm.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1566.004 (Phishing: Spearphishing Voice) (mapping per source article); Resource Development → T1583.001 (Acquire Infrastructure: Domains), our sub-technique for the source’s T1583 (Acquire Infrastructure) mapping

Sources: “Silent Ransom Group – Leak Analysis”, Ransom-ISAC, Oct. 26, 2026, https://ransom-isac.org/blog/silent-ransom-group-leak-analysis/ (source article)

Unsanctioned Remote Desktop Tool on Legal and Finance Workstations

Ransom-ISAC confirms AnyDesk as the group’s core access tool: the victim, believing they are talking to IT, downloads and opens it and reads out the session code, and the operator then works the machine by hand. The leak also references RDP, Zoho Assist and VPN access, and a planned variant delivering AnyDesk on a USB stick. The detection logic is an endpoint rule that flags a remote desktop tool (AnyDesk, Zoho Assist and similar remote-support clients) whose process starts from a user-writable path such as Downloads, %TEMP% or the desktop, or that is first seen on a host, where the tool is not on the organization’s approved list; raise severity on machines used by legal, finance and executive assistant staff, and when the tool’s first network connection to its relay service follows within minutes of the process start.

Use EDR process-creation and file-creation events, application-inventory data, and proxy or DNS logs for the vendors’ relay domains. Sweep 90 days, then run continuously. Allowlist by the signed binary from the approved installation path and the publisher’s code-signing certificate, not by process name, because the attacker’s copy is the real, signed AnyDesk binary; for the same reason hash blocking is the wrong control, since it will either miss a different version or break sanctioned use. If the organization does not use AnyDesk at all, block its relay domains at the proxy and its installer by application control, which ends this route outright. Any hit on a legal or finance workstation should be confirmed with the user directly, by a known number, the same day, and if they did not request support, treated as an incident: isolate the host, end the session and pull file-access and upload logs for the session window. The rule generalizes to every help-desk impersonation crew that relies on legitimate remote-support software.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1219.002 (Remote Access Tools: Remote Desktop Software); the source article maps the parent T1219 (Remote Access Tools) under Execution, and we use the sub-technique because the tools named are remote desktop software

Sources: “Silent Ransom Group – Leak Analysis”, Ransom-ISAC, Oct. 26, 2026, https://ransom-isac.org/blog/silent-ransom-group-leak-analysis/ (source article)

Bulk Upload to Consumer Cloud Storage From Legal Workstations

Once connected, the operators collect client files from the local machine and mapped shares and push them to attacker-owned Google Drive accounts (the leak records four accounts delivered on Sept. 4, 2026) and Yandex Disk links; Ransom-ISAC confirms the theft was done by hand, not with an exfiltration utility. Its hunting guidance adds the companion signals of one workstation reading many files across shares in a short window, large archive creation followed by an outbound transfer, mass searches followed by bulk export in a document-management system such as iManage, and unexpected rclone, WinSCP or MEGA clients. The detection logic is a proxy or CASB rule that sums upload bytes per user to consumer cloud storage (personal Google Drive, Yandex Disk, MEGA and similar) over a rolling hour and alerts when the total exceeds the user’s 30-day baseline by a large multiple, joined to an EDR or file-server signal of a burst of file reads from the same host in the preceding hour.

Use secure web gateway or proxy logs with upload byte counts, CASB or cloud-app logs that can tell a personal Google account from the corporate tenant, file-server audit logs and document-management audit logs. Sweep 90 days, since victims sometimes learn of the theft only from the extortion email weeks later. Scope to workstations that hold client files: legal, finance, HR and executive support. Expect matches from staff moving their own files to personal storage; tune by excluding the corporate Google Workspace or Microsoft 365 tenant, not by excluding users. Blocking all of google.com is the wrong choice because staff need it; block or tenant-restrict uploads to personal storage instead. A large upload that falls inside a remote-access session window should be escalated to incident response immediately, and legal counsel should be engaged because client data notification may be required. The rule generalizes to any hands-on-keyboard data-theft extortion.

Hunt Lead Level: 2 (Pro)

ATT&CK: Collection → T1005 (Data from Local System); Exfiltration → T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage) (mapping per source article)

Sources: “Silent Ransom Group – Leak Analysis”, Ransom-ISAC, Oct. 26, 2026, https://ransom-isac.org/blog/silent-ransom-group-leak-analysis/ (source article)

Remote-Access Session Within 30 Minutes of an Inbound External Call

The whole intrusion turns on one phone call: the operator rings a staff member from the 3CX PBX, claims to be IT or a vendor responding to a problem nobody reported, and walks them through installing or opening the remote-access tool. Ransom-ISAC calls a remote-access install within 30 minutes of an inbound external call a strong indicator, and lists a remote-access tool first seen on a host near an inbound external call as one of its highest-value detection points. The detection logic is a cross-source correlation keyed on the user: a call detail record of an inbound call from a number outside the organization’s own helpdesk and known vendor numbers, answered on that user’s extension or softphone, followed within 30 minutes by the first execution of a remote desktop tool, or the first connection to a remote-access relay, on a workstation where that user is logged on.

This needs PBX or UCaaS call detail records (Microsoft Teams Phone, Zoom Phone, RingCentral and on-premises PBXs all export them), a mapping of extensions to users, EDR process events and logon events in one SIEM. Run it continuously and back-test over 90 days. The main tuning step is an allowlist of the helpdesk’s and managed service provider’s outbound numbers, kept current; calls from those numbers drop out. Mobile phones are a blind spot when staff take the call on a personal device, so pair this with the unsanctioned-tool lead, which still fires without call data. Any hit is an escalation, not a tuning exercise: call the user back on a known internal number, end the session if they did not initiate it, and review file access and uploads during it. The correlation generalizes to every vishing-led intrusion, including help-desk impersonation by other groups.

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1566.004 (Phishing: Spearphishing Voice) (mapping per source article); Command and Control → T1219.002 (Remote Access Tools: Remote Desktop Software)

Sources: “Silent Ransom Group – Leak Analysis”, Ransom-ISAC, Oct. 26, 2026, https://ransom-isac.org/blog/silent-ransom-group-leak-analysis/ (source article)

Hash Appendix

No published YARA, Sigma or KQL rules: Ransom-ISAC gives detection guidance in prose only. The group uses no malware, so there are no payload hashes; the hashes below are the leaked files themselves, useful mainly for matching copies of the fake resume or call script if they reach a mailbox or file share.

Leaked SRG operational files

SHA-256 values come from the source article. The source gives no MD5 or SHA-1, and AlienVault OTX had no record of any of the four SHA-256 values when checked on Oct. 29, 2026; VirusTotal was not queried.

MD5s

(not available)  # chat_export_full.json.gz -> leaked Rocket.Chat export (gzip JSON)
(not available)  # target_list_naval_bases.xlsx -> leaked target list (Excel)
(not available)  # fake_employee_resume.pdf -> fake job-applicant resume (insider-placement plan)
(not available)  # vishing_call_script.txt -> operator call script

SHA1s

(not available)  # chat_export_full.json.gz -> leaked Rocket.Chat export (gzip JSON)
(not available)  # target_list_naval_bases.xlsx -> leaked target list (Excel)
(not available)  # fake_employee_resume.pdf -> fake job-applicant resume (insider-placement plan)
(not available)  # vishing_call_script.txt -> operator call script

SHA256s

41900fbcc8a172629c695bba46ad15b7981610ea52d3a61ab4061fd6d860e809  # chat_export_full.json.gz -> leaked Rocket.Chat export (gzip JSON)
4bee44ec615b61d6f1acdb4b3d92497f9f200757f4b6653068dce23a9f100d4f  # target_list_naval_bases.xlsx -> leaked target list (Excel)
a6a580e4aff45d4812123eb18ec7bd1c53f44b3369e3b430d7b72f4cdb30778e  # fake_employee_resume.pdf -> fake job-applicant resume (insider-placement plan)
d2f3a78a814ca628ca54358cc35808b8bd032bcde81f72134addc05e5546285e  # vishing_call_script.txt -> operator call script

References Appendix

• “Silent Ransom Group – Leak Analysis”, Ransom-ISAC Research Team, Oct. 26, 2026, https://ransom-isac.org/blog/silent-ransom-group-leak-analysis/ (source article; leak provenance, intrusion chain, infrastructure, IOC registry, ATT&CK mapping, detection and hunting guidance, file hashes)
• AlienVault OTX file indicator lookups for the four SHA-256 values, Oct. 29, 2026, https://otx.alienvault.com/ (no records found)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/