The most lucrative ransomware operation of the year never encrypted a single file. According to internal chat logs leaked this week and analyzed by blockchain forensics firm Crystal Intelligence, a cybercrime collective known as Silent Ransom Group — also tracked as Luna Moth — claims it collected roughly $207 million from 27 law firms between April and September 2026 using nothing more than phone calls, social engineering, and the threat of publishing stolen data.
The leak, first shared with the DataBreaches research site by researcher Tammy Harper, contains 5,692 internal messages spanning August 2025 through September 2026. The chats cover ransom negotiations, methods for gaining access to victims' systems, and plans for future targets. They read less like a clandestine criminal enterprise and more like a sales organization, with members swapping tips on how to manipulate victims into paying.
Silent Ransom Group's playbook is strikingly low-tech. Callers pose as internal IT staff or service providers, convincing attorneys and support staff to upload files to attacker-controlled accounts, hand over credentials, or grant remote access through tools like Quick Assist and AnyDesk. Once data is exfiltrated, the group demands payment under threat of public disclosure — pure data extortion, with no encryption payload deployed at any stage.
Confirmed victims include Blank Rome, which reported an incident in which an attacker posing as IT personnel persuaded an employee to facilitate file uploads, and Goodwin Procter, which confirmed an employee was deceived into surrendering credentials. Other firms named in the group's internal records include White & Case — alleged to have paid $30 million — along with Hogan Lovells, Cadwalader, and Sheppard. None of the named firms have publicly confirmed payment amounts.
Crystal Intelligence examined the cryptocurrency transactions referenced in the chats and concluded that blockchain data supports the overall scale of the operation, though the exact $207 million figure could not be independently confirmed. The analysis describes an elaborate cash-out apparatus: single-use wallets, instant exchangers paying out to Russian bank cards, a Bitcoin-to-Zelle desk, coin-mixing wallets, and even a Moscow cash courier. Ironically, the group's own messages show its strict anti-tracing wallet rules were frequently ignored — smaller payments often went straight to regulated exchanges tied to verified identities, which investigators call the network's weakest point.
The scale of the haul — a median payment of roughly $6 million per victim, according to one analysis — puts Silent Ransom Group among the most successful extortion operations ever documented, and it did so without developing malware, buying exploits, or managing a complex encryption infrastructure. For enterprise defenders, the lesson is pointed: the fastest-growing attack surface is the human voice. Phone-based social engineering, sometimes called vishing, bypasses endpoint detection, network segmentation, and backup strategies alike, because the attacker never touches the network's defenses — they are invited in.
Security teams at professional-services firms, which hold sensitive client data across mergers, litigation, and intellectual property, face particular exposure. The group's targeting of law firms appears deliberate: firms are reluctant to report incidents, eager to protect client confidentiality, and well-capitalized enough to pay quickly.
Law enforcement has not confirmed the leaked figures. But with nine of the 27 named victims having reported breaches in 2026 that correspond in time to the leaked material, the records are consistent with a sustained campaign that is likely ongoing. The group has denied its systems were breached, despite the publication of its internal communications.