Silent Ransom Group sent recruited 'agents' into US law firm offices, leaked chats show

The entry plan in the chats has two steps. One participant proposed buying delivery uniforms and insulated bags. "We buy these insulated bags and uniforms for agents," he wrote, describing an operative who would get past reception delivering pizza and then pose as an IT worker in the main office ^[10]. The FBI has already published the second step. A flash alert earlier this year warned that Silent Ransom Group members were posing as IT personnel to gain physical access to computers ^[7].

The gang budgeted for props. An earlier shopping list included a $3,200 printer with ultraviolet capability and holographic materials for producing ID cards, and the archive records money sent to forgers, one of them in New York ^[12]. Other members proposed custom masks modelled on real lawyers, and smart glasses for an agent posing as a client to record an office interior ^[11]. Nothing in the archive shows whether the pizza ruse or the masks were used ^[13].

The leak's origin is anonymous. The archive appeared on a bespoke .onion site in early October, posted by an unidentified source who did not state a motive ^[2]. It covers about 13 months of messages ^[19] and mixes apparent extortion records with brainstorming, abandoned plans, boasting and violent fantasies ^[4]. Chainalysis matched cryptocurrency addresses in it to known Silent Ransom Group extortions, but said it could not "speak to the totality of claims" in the archive ^[5][6]. The group is also tracked as Luna Moth and Chatty Spider ^[5].

The chats also describe plans to kidnap business executives and to recruit military personnel to spy on submarine-based nuclear forces ^[1]. Recorded Future News could not verify whether the most extreme schemes were ever attempted ^[4]. On current evidence those plans are talk. The office walk-in has a victim's own account in a negotiation and an FBI alert behind it ^[8][7].

Over those 13 months, members tracked dozens of victims and haggled over multimillion-dollar payments. Some organizations named in the chats have not publicly acknowledged a breach ^[3]. Recruitment was messy, according to the messages. A roster lists agents by numbered code and city, including a 17-year-old marked ready to work and noted as underage, and one channel name suggests an agent was caught in Chicago ^[15]. Some recruits vanished after being paid or backed out at office entrances. Others went on paid test assignments, and one member called the process a conveyor belt ^[16]. Recorded Future News compared the model to the disposable agents recruited by Russian and Iranian intelligence services ^[18].

Not every recruit was told the plan. One member suggested explaining the scheme fully only "to those who we trust fully" ^[17]. In my view the control that matters for a law firm sits at the desk and the workstation: confirming that someone the firm knows scheduled the IT visit before a stranger touches a machine. In both the FBI alert and the New York case, a stranger reached a computer inside the office ^[7][8].