Inside a Cybercrime Operation That Turned Stolen Legal Data Into Massive Payouts
Leaked internal communications attributed to the cybercrime operation known as Silent Ransom Group (SRG) suggest its members collected approximately $207 million from 27 law firms between April and September 2026.
The figures emerged from 5,692 messages spanning August 2025 through September 2026. Blockchain investigators have corroborated some financial activity, but the total remains unverified.
The case illustrates how criminals can pressure organizations into multimillion-dollar settlements through data theft and exposure threats rather than deploying file-encrypting ransomware.
Social Engineering Replaces Traditional Malware
Also tracked as Luna Moth, Chatty Spider and UNC3753, the operation has targeted law firms alongside healthcare, finance and insurance organizations.
Fake IT Support Opens the Door
According to the FBI, attackers impersonate internal IT personnel through phone calls and phishing emails, persuading employees to grant remote access or disclose credentials.
In some cases, operatives have reportedly appeared at victims' offices to obtain physical access.
Once inside, attackers use legitimate utilities, including WinSCP, Rclone, Google Drive and OneDrive, to extract sensitive documents.
The stolen information becomes leverage in negotiations, with threats to publish confidential client records.
Internal Records Describe Enormous Payments
The leaked deal board lists 27 organizations marked as having paid, with a reported median payment of $6 million.
Largest Claimed Settlement Reached $30 Million
One entry attributes a $30 million payment to White & Case, although independent verification of that specific settlement remains unavailable.
Researchers also identified inconsistencies between internal payment classifications, negotiations and publicly documented incidents.
Crystal Intelligence confirmed that certain cryptocurrency transfers matched the timing and amounts discussed in the messages. However, those findings do not authenticate every claimed payment or establish the $207 million total.
Bitcoin Transactions Expose Cash-Out Infrastructure
The communications describe a laundering operation designed to move extortion proceeds through multiple financial channels.
Wallet Reuse Created Investigative Opportunities
Operators reportedly used single-purpose Bitcoin addresses, instant cryptocurrency exchangers, Russian bank-card payouts, cash intermediaries and Bitcoin-to-Zelle conversion services.
Despite instructions intended to limit traceability, some members reused addresses or transferred funds through regulated exchanges.
These mistakes created transaction links that investigators could follow, potentially connecting criminal proceeds to identifiable financial accounts.
Victim Disclosures Support Parts of the Investigation
Researchers compared the leaked records with publicly reported security incidents.
Documented Intrusions Match Known Tactics
Blank Rome disclosed an incident involving an attacker posing as internal IT personnel and persuading an employee to upload documents to an external Google Drive.
Goodwin Procter also reported an employee being deceived into providing credentials.
These incidents are consistent with SRG's documented methods, although matching techniques and timelines do not independently verify the group's claimed ransom amounts.
Data Theft Alone Can Sustain Major Extortion Campaigns
The investigation demonstrates that encryption is no longer essential to profitable cyber extortion.
Organizations holding sensitive legal and financial information face substantial exposure when attackers obtain legitimate remote access or convince employees to transfer confidential files.
Defensive priorities include verified IT-support procedures, restrictions on remote-access tools, monitoring of unusual cloud uploads, and stronger physical-access controls.
The broader lesson is that preventing unauthorized data movement matters as much as protecting systems against conventional ransomware.