Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider and UNC3753, is a Russian-speaking cybercriminal organization active since at least 2022 and associated with the BazaCall and Conti criminal ecosystem. It is known mainly for data-theft extortion against U.S. law firms, and it has steadily built physical access into its operations. The FBI has documented SRG sending individuals posing as IT personnel into victim offices to reach computers directly.
Internal communications of the group show that this physical component is part of a broader human-enabled capability. SRG operators discuss recruiting and tasking U.S.-based personnel, running physical reconnaissance, cultivating insiders, using false identities, and using sexual-entrapment techniques to approach or compromise persons of interest. The same communications contain discussions of weapons, physical coercion and abduction.
Stopping an SRG remote intrusion does not end an SRG operation. Against a target the group values, a failed remote attempt is a reason to send a person.
Key judgments
Each judgment carries a likelihood, a confidence level, and the attribution rung it rests on.
| # | Judgment | Likelihood | Confidence | Rung |
|---|---|---|---|---|
| 1 | SRG runs an integrated capability that combines remote intrusion and social engineering with personnel operating in the physical environment. | Almost certain | High | A1 |
| 2 | SRG recruits and tasks individuals located in the United States for physical access, reconnaissance and the cultivation of insiders. | Almost certain | High | A1 |
| 3 | Sleepless Threat is a continuation or rebranding of SpyCo, and both operated inside the broader SRG ecosystem. | Highly likely | Moderate | A3 |
| 4 | SRG has planned interpersonal and sexual-entrapment approaches against selected persons of interest. This is a judgment about planning and intent, not execution. | Highly likely | Moderate | A1 |
| 5 | Coercive or violent methods, including weapons, intimidation and abduction, have been discussed as operational options rather than only as rhetorical pressure. | Probable | Moderate | A1 |
| 6 | Some SRG collection requirements against U.S. defense and military targets have no immediate monetization path visible in the material. | Probable | Moderate | — |
| 7 | The internal ledger total of roughly $207 to $208 million reflects actual proceeds received. | Chances about even | Low | — |
Rungs are attribution thresholds: A1 activity cluster, A2 persona, A3 persona cluster, A4 named legal entity, A5 state or unit nexus.
How to read this
Two rules run through this assessment. First, a statement that actors discussed something is not a statement that they did it. The communications establish planning, tasking and intent; for insider operations, interpersonal approaches and coercive methods, they do not establish that any individual proposal was carried out. Second, a company's appearance in actor communications does not establish that it was compromised. Named organizations fall into four groups: confirmed victims, attempted targets, prospective targets, and entities the actors merely discussed. Collapsing those groups is the most likely way for this material to be misread, and we name none of them here.
Background
SRG emerged in 2022 from the callback-phishing ecosystem around BazaCall, a social-engineering operation historically connected to actors in the broader Conti ecosystem. Unlike conventional ransomware groups, SRG generally does not depend on file encryption. Operators use social engineering to get into victim environments, exfiltrate sensitive information and demand payment under threat of disclosure.
Earlier campaigns relied on emails impersonating legitimate subscription services and directing recipients to attacker-controlled telephone numbers, where operators persuaded victims to install legitimate remote-access software. The group's methods then moved toward direct impersonation of corporate IT personnel and more aggressive attempts to obtain access.
Through 2022 and early 2023 the group ran broad, sector-agnostic campaigns; the narrowing onto legal services came later. U.S. law firms have been a sustained focus since at least spring 2023, because they hold privileged communications, litigation material, intellectual property, transaction records and other sensitive client data.
The FBI's FLASH alert of May 26, 2026 documents the change in method: when a remote attempt fails, SRG sends someone posing as IT staff to the victim's location to insert a storage device into a computer and take the data directly. Putting personnel in the physical environment shows that SRG will move beyond remote intrusion when conventional social engineering is not enough.
An enterprise, and a rebrand
The communications describe a structured criminal enterprise with differentiated functions, not a loose set of operators cooperating on individual attacks. Participants appear responsible for leadership and financial decisions, technical infrastructure, victim acquisition, social engineering, negotiations, recruitment, physical operations and payment handling. Personnel working in the physical environment appear connected to the same ecosystem that supports cyber operations, and compartmentalization lets them be given narrow tasks without understanding the broader objective or target.
The communications also clarify the relationship among SRG, SpyCo and Sleepless Threat. SpyCo appears to have operated inside the broader SRG ecosystem. Sleepless Threat then emerged as a continuation or rebranding of the SpyCo operation rather than as a wholly independent actor, with continuity in personnel, victim activity, operational relationships, workflows and internal references. Activity attributed externally to SpyCo and to Sleepless Threat may be two manifestations of the same underlying network.
Human-enabled operations
Recruitment and physical access. The material describes the recruitment and management of individuals located in the United States. They provide what overseas operators cannot: entering buildings, interacting directly with employees, accessing computers, conducting reconnaissance, observing security procedures, identifying personnel, or opening the way for another actor.
Insider cultivation. The communications show repeated interest in people who hold or could obtain privileged access. Employees, contractors and other trusted personnel can supply physical access, internal information, credentials, documents or knowledge of security procedures that is hard to acquire remotely. Participants discuss identifying such individuals and, in some cases, paying them. The material does not establish that every contemplated insider operation was executed. It does establish that insider recruitment is treated as a viable method.
Sexual entrapment and interpersonal cultivation. The communications contain discussions of using sex workers or other individuals to approach selected persons of interest, and of using sexual or interpersonal relationships to develop proximity to a target, obtain information, create leverage or enable later access. These discussions resemble techniques associated with traditional human intelligence work and organized crime more than with conventional ransomware activity. The evidence establishes planning and intent, not execution.
Coercion, weapons and violence. Separate conversations concern weapons, physical intimidation, abduction and other coercive methods. Some describe proposed operations; others are actor claims that the communications alone cannot establish. Even so, violence is not discussed solely as rhetorical pressure on an extortion victim. In parts of the material, physical coercion is considered as a means of obtaining access, information or compliance. That moves SRG activity out of cybersecurity alone and into physical security and personnel protection.
Targets beyond extortion
SRG remains principally financially motivated, and much of its victim activity fits data theft and extortion. Law firms remain a core target set, alongside other professional-services and commercial organizations, following a familiar model: obtain access, steal sensitive information, and use the threat of disclosure to force payment.
The communications also reference U.S. defense and technology organizations, including companies supporting sensitive government and national-security missions, and in some instances discuss obtaining information through employees or others with access rather than only through network intrusion. Further discussion covers military installations, military personnel and individuals positioned to obtain sensitive information. Some of these requirements appear collection-oriented rather than tied to an extortion demand.
The distinction matters. A financially motivated criminal organization may seek defense information for resale, future extortion, access brokerage or sale to another buyer, so the absence of a visible ransom objective does not establish espionage.
The money
The communications describe substantial cryptocurrency activity tied to victim payments, operator compensation, contractors and other operational expenses. An internal ledger claims roughly $207 to $208 million in payments during the period the material covers. That is an actor-maintained figure, not verified revenue, and should not be cited as such. Blockchain analysis corroborates significant activity consistent with parts of the communications, but individual ransom amounts cannot be attributed to specific victims. Operators emphasize compartmentalization: fresh cryptocurrency addresses, separated victim proceeds and multiple cash-out routes. Payments also appear to support people and services outside the core cyber operation, including field personnel.
What this means for defenders
Assess SRG as a financially motivated criminal organization with integrated cyber and human-enabled capabilities, not only as a data-extortion actor. Its cyber methodology remains central, and social engineering, remote access, data theft and extortion still explain most of its targeting. The human component materially expands that capability.
For law firms, defense-sector organizations and the agencies that protect them, SRG activity crosses organizational security boundaries. A cyber incident may have a physical component. An approach to an employee may connect to an ongoing intrusion. A failed remote-access attempt may precede an effort to get in through locally recruited personnel or insiders. Treat suspected SRG activity as relevant to cybersecurity, physical security, insider threat, counterintelligence, corporate investigations and personnel protection at the same time.
The most consequential part of SRG's evolution is not any individual tactic. It is the group's ability to combine them: cyber access, social engineering, physical presence, human recruitment, insider access and interpersonal targeting operate as components of one criminal enterprise.
About this assessment
This assessment was produced by GHOST, AFTRDRK's intelligence unit. It draws on internal communications of the actor group, corroborating public reporting including the FBI's documentation of SRG physical-access activity, blockchain analysis of associated cryptocurrency activity, and open-source material. Communications content was lawfully acquired, and no AFTRDRK collection involved unauthorized access to third-party systems. We describe source categories, not sources.
Its conclusions are analytic judgments made in good faith on the evidence described. They are not findings of fact by any court or competent authority, parts of the underlying material can be only partly verified, and the assessment is open to revision as further material arrives. It is not legal, compliance or financial advice.
If SRG is a concern for your organization, we can brief your security, legal and executive teams.