Money trail backs leaked chats from extortion crew that walks into US law firms
Researchers corroborate parts of Silent Ransom Group dump detailing crypto payouts, cash brokers, and recruitment
Recent cryptocurrency transactions lend credibility to leaked communications from the Russian extortion crew Silent Ransom Group (SRG), according to blockchain analysis firms Chainalysis and Crystal Intelligence. Chainalysis confirmed that certain leaked wallet addresses are linked to SRG's past ransomware payments, while Crystal traced funds to an upstream collection wallet receiving around 2,675 bitcoins.
The leaked chats claim SRG received approximately $207 million from 27 firms between April and September 2026. The group's methods include stealing data and demanding payment rather than deploying ransomware, often through callback phishing and physical intrusions. Chainalysis traced hundreds of thousands of dollars in funds sent from a known SRG member's wallet, which were used to pay for SRG's expenses, including members' wages and IT infrastructure.
Crystal identified a range of ways SRG spent the funds, such as through instant exchangers, Russian bank cards, and a Moscow-based broker named Zhenya who provided physical cash. The leaked chats also suggest SRG suspected Zhenya of skimming money through the exchange rate. The riskiest payment method involved smaller sums paid directly to field agents and document forgers, who received payments into their exchange wallets.
The leaked material appeared under the title "The Luna Moth Files," referencing another name used for SRG. The group has been active since around 2022, primarily targeting law firms but branching out to other organizations.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
