Breaches and incidents
Silent Ransom Group (Luna Moth): “The Luna Moth Files” leak of the extortion group’s internal chats and wallets
Reuters (via Insurance Journal, 8 Oct) reported an anonymous site titled “The Luna Moth Files” claiming to host Silent Ransom Group chat logs, ransom...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Reuters (via Insurance Journal, 8 Oct) reported an anonymous site titled “The Luna Moth Files” claiming to host Silent Ransom Group chat logs, ransom demand totals, documents and dozens of crypto wallet addresses; Chainalysis said some leaked addresses “sit downstream of millions of dollars in ransomware payments”, including one tied to a $10 million victim payment in mid-2026.
- Root cause: how the data was obtained is not disclosed; nobody has been identified as the leaker.
- Attacker: SRG (also tracked as Luna Moth, Chatty Spider, UNC3753), which the FBI warned in May targets law firms by impersonating IT staff. Reuters “could not immediately verify the authenticity” of the data; Check Point’s analysis (per Infosecurity Magazine, 12 Oct) is conditioned “If authentic”.
- Check Point says the files show scripts for emotionally manipulating victims into granting remote access; Security Affairs (citing DataBreaches) separately reports leaked chats alleging about $207 million paid by 27 law firms, which Crystal Intelligence says on-chain data supports in scale but not exact figures.