Law Firms Are the Names in the Ledger. Deal Data Is the Product.

5:45 PM Central

At 5:39 PM Central on Sunday, October 11, 2026, Cloudskope asked Google's public DNS resolver where business-data-leaks.com lives. That is the address the FBI and Google's Mandiant team have both published as the leak site of the Silent Ransom Group, the Russian-speaking extortion crew that has spent three years breaking into American law firms. The resolver answered with ten IP addresses on ten different consumer internet providers in nine countries: Egypt, Colombia, Ecuador, Panama, Argentina, Uzbekistan, Bulgaria, Croatia, North Macedonia. Each record carried a time-to-live of 150 seconds.

At 5:45 PM we asked again. Five of the ten addresses had changed. South Korea, Peru and Kyrgyzstan had joined the list.

That is what the infrastructure of a working extortion business looks like five days after its private chats were dumped on the internet. The Luna Moth Files, roughly 5,700 internal messages spanning late August 2025 to late September 2026, appeared on an anonymous onion site in the first week of October. The group says they are fake. Two blockchain analytics firms say some of the money in them traces to real ransom payments. And between October 5 and October 8, as the archive surfaced and researchers began reading it, a public tracker recorded eight new victims on the site whose DNS we were watching rotate.

One of the most revealing moments in the archive is not technical. In a negotiation described by Alexander Martin of The Record, a law firm's representative tells the extortionists that the firm knows a person walked into its New York office and copied files onto a flash drive. The firm's executives, the representative says, have authorized $1 million to settle. The firm wants proof that every digital and physical copy will be destroyed, and it cites evidence that LockBit had failed to delete data from victims who paid.

A law firm that knew it had been robbed in person was asking a criminal for a receipt.

The leak is not the story. The story is that the FBI told American law firms in writing, in May 2025, exactly how this group gets in: a phone call from someone claiming to be IT, followed by a stranger at the front desk with a USB drive. The story is that the entries marked paid in the group's own ledger, 27 of them between April and September 2026, add up to about $207 million by one analytics firm's tally. The story is that the next names on its target list, according to the leaked plans, are not law firms. They are accounting firms, insurers and financial services companies. And the story, for anyone who sits on a board or runs a deal, is that the outside firms holding your merger agreements, your disclosure schedules and your executives' tax returns are a side door that almost no diligence questionnaire asks about.

What we verified, and what the first reports could not

Cloudskope did not open, download or read the leaked archive, did not visit any onion site, and did not load the group's leak site. Apart from one TLS handshake attempt to the leak-site domain, which our own egress proxy intercepted and which returned nothing about the site, every check below is passive and public: DNS, registration data, network ownership, court dockets, public trackers and public web pages. The full log, with commands and timestamps, is held with this analysis.

• The leak site is on fast-flux DNS. (Observed.) Between 5:39 and 5:49 PM Central on October 11, business-data-leaks.com resolved to 15 distinct IPv4 addresses across 14 autonomous systems in 12 countries, with a 150-second TTL. Every address belonged to a consumer or regional internet provider (Telmex Colombia, Telecom Argentina, SK Broadband, A1 Bulgaria, TE Data and others). None belonged to a hosting company or a CDN. Half the set rotated within about six minutes of our first query. That pattern is the signature of fast-flux hosting: the domain points at a moving pool of what are, most likely, compromised or proxied home devices that relay traffic to a hidden origin. (The compromised-device explanation is our hypothesis. We did not identify the origin server.)
• The domain was touched after the leak. (Observed.) RDAP shows business-data-leaks.com was registered on February 19, 2024 through WebNic.cc and last changed on October 9, 2026 at 12:09 UTC, two to three days after the archive surfaced. Its four nameservers sit on heopldenticalderr.org, a domain registered through the same registrar on February 22, 2026. The two we resolved also point to consumer ISP addresses, one of them shared with the site itself. We cannot see what changed on October 9.
• The group kept posting. (Observed, via tracker.) The public tracker ransomware.live, which we queried through its API, records 82 Silent Ransom Group postings in 2026 so far, eight of them classified as financial services. It recorded three new postings on October 5, one each on October 6 and 7, and three on October 8, the last at 6:22 PM Central. Those are the tracker's discovery times, which can lag the group's own posting times. S-RM's incident response team assessed that the group was running at full capacity when the leak occurred. The tracker agrees.
• The Mandiant indicators point somewhere else. (Observed.) Of the seven IP addresses Google's threat intelligence group published on June 5 for the actor it tracks as UNC3753, four sit in a single US hosting provider, Hostwinds (AS54290), and six of seven are in US-registered networks. Mandiant does not say what role each address played. The contrast is still instructive: the infrastructure that touches victims sits in ordinary US hosting, where specific addresses can be blocked, while the infrastructure that publishes stolen data is built so that nobody can get it taken down with an abuse email.
• Law-firm breach notices in California have more than doubled. (Observed, with a stated method.) We downloaded the California Attorney General's full breach-notice export and counted notices filed by law firms between January 1 and October 11 of each year. In 2025 there were 7. In 2026 there are at least 18, from at least 16 firms. California requires a notice only when 500 or more of its residents are affected, and notices lag incidents by months. Nothing in the count itself ties any filer to the Silent Ransom Group, although one filer, discussed below, has been linked to the group by press reports. We are not naming the others. The count says law firms in California's dataset are filing at more than twice last year's pace. It does not say why.
• MonsterCloud's website still makes the claim prosecutors call false. (Observed.) At 5:41 PM Central on October 11, four days after the owner of the Florida ransomware recovery firm MonsterCloud was arraigned in Brooklyn on wire fraud charges, its ransomware data recovery page was live and still told visitors that its team helps businesses "recover their data without succumbing to ransom demands" using "advanced decryption techniques." That is the claim the U.S. Attorney's Office quoted in announcing the case. More on why this belongs in a story about law firms below.
• The Dobrovsky docket. (Observed.) The federal court docket in United States v. Dobrovsky, E.D. Pa. No. 2:26-mj-01973, shows that the arrest of the ransomware negotiator KrebsOnSecurity reported on October 9 was processed on October 8 as a Rule 5 transfer to Texas. The docket spells his name Dobrovsky; Krebs reports the court records misspell it and that the Bureau of Prisons lists him as Edward Dubrovsky. KrebsOnSecurity reported that, as of its writing, he had no attorney and no public defender. The docket's bail order, signed October 8 and entered October 9, shows the court appointed the Federal Defenders, that he stipulated to identity and probable cause, and that he was detained pending a hearing in the charging district. That is most likely a timing difference between the article and the docket, not an error, and we note it only so the record is precise.

What we could not verify: the archive as a whole (nobody has); the $207 million figure, which is a tally of the group's own ledger entries; whether any specific firm paid; and how many lookalike "-itdesk" and "-helpdesk" domains have been registered against specific firms, because the certificate-transparency and scan databases we tried do not allow that wildcard search without an account. A firm that monitors certificate transparency for its own name can run that check in an afternoon.

What the Luna Moth Files are, and what they are not

The archive surfaced on or about October 5 or 6 on a .onion site titled The Luna Moth Files, after one of the names researchers use for the group. The Silent Ransom Group is also tracked as Chatty Spider, UNC3753 and Storm-0252. According to S-RM, the archive holds 5,692 messages, mostly in Russian, exported from two internal servers and covering roughly 13 months. DataBreaches.net, which S-RM says first reported the leak on October 7, puts the range at about August 25, 2025 to September 29, 2026. Whoever published it has not said who they are or why.

Three independent firms have now read it, and their caveats matter as much as their findings.

Check Point's Uriel Sigal described chat exports, a vishing script, screenshots and a purported fake employee resume, organized under labels such as CHAT, OFFER, CONTRACT and GOLD, with revenue estimates and wallet requests. He also noted that the leak site shows two different message totals and that its headline financial figure does not reconcile with its own table. Check Point treats every claim in the archive as unverified unless an outside source confirms it.

Chainalysis, as reported by Reuters' AJ Vicens and The Register's Connor Jones, said some leaked wallet addresses match intelligence it held before the leak and trace to ransomware payments the group extorted, totaling millions of dollars. Per The Register, one member's wallet was funded entirely from a victim payment of more than $10 million collected in mid-2026, a payment Chainalysis had already been tracking, and Chainalysis said it could not authenticate the collection as a whole.

Crystal Intelligence, in a report by chief intelligence officer Nicholas Smart, traced named wallets that received about 37 BTC (about $3 million, of which about $2.7 million was the operators' personal cut), and an upstream collection wallet that received 344 BTC (about $27 million) in six weeks during April and May 2026 and about 2,675 BTC over its lifetime, on the order of $200 million at recent prices by Cloudskope's rough conversion. Crystal is explicit that the confirmed amounts are operator shares, not whole ransoms, and that individual victim payments cannot be matched to individual wallets.

The group, for its part, told DataBreaches.net on October 8 that it had never been breached, that an internal audit found no leak, and that the material is false. DataBreaches.net found several details that check out against the real world, including live accounts and domains registered during the relevant period. It also cited the researcher Yelisey Bohuslavskiy's point that when Conti and Black Basta suffered leaks, they acknowledged them immediately. This group says its books are forged while its leak site keeps publishing.

So the honest position is the one every serious reader has taken. The archive mixes real extortion records with brainstorming, abandoned plans and boasting. Parts of the money trail are corroborated on-chain by two firms working independently. The totals come from the criminals' own entries, and the archive's own figures do not reconcile with each other. We will use them as claims, and label them that way.

The ledger moves in four stages: chat, offer, contract, gold

The archive's pipeline is the most useful thing in it for a board, because it describes how a law firm moves from a phone call to a wire. Victims progressed through four labels. Chat meant contact had been made. Offer meant a number was on the table. Contract meant terms were agreed. Gold meant paid.

According to Crystal's reading of the chats, 27 firms were marked gold between April 3 and September 24, 2026, and adding up those entries gives about $207 million. The group's own running figures are lower and inconsistent: on May 4 an operator claimed $43.95 million "received this season," and a September 21 message, per Crystal, reads "$51M made, plan $350M." The Record reports that a $100,000 opening offer from one victim was mocked as "missing a zero," that later entries ranged from $500,000 to $3.5 million, and that one contract reached $6 million. About 50 organizations appear in the records, mostly law firms. Several have publicly disclosed cyber incidents this year. Others have not.

DataBreaches.net adds a detail that should interest any general counsel. Of the 27 apparent payers named in the messages, nine have publicly disclosed incidents whose dates and descriptions are consistent with Silent Ransom Group attacks. That leaves as many as 18 that, on the face of the public record, have not. No law firm has confirmed or denied paying.

The sector concentration is not subtle. Check Point counted 42 law firms among the group's 50 most recently observed victims. S-RM put law firms at about 78 percent of the group's known 2026 victims, which it described as far higher than any other major extortion group. The chats, per Check Point, state an ambition to work through the top 100 law firms in the world.

The negotiation tactics in the archive will be familiar to anyone who has sat in an incident war room. Operators call senior executives from short-lived numbers, sometimes posing as a third party. They set short deadlines. They threaten to contact clients and staff, and they do. They cite earlier victims and press coverage as pressure. Google's Mandiant team, in its June report, measured how fast this happens: extortion emails often arrive within 30 minutes of the data leaving the network, carrying a three-day deadline.

The FBI wrote it down in May 2025

Every firm in that ledger had access to the first of two documents, and most had both. Read them in order.

On May 23, 2025, the FBI issued Private Industry Notification 20250523-001, coordinated with CISA and released TLP:CLEAR, titled Silent Ransom Group Targeting Law Firms. Its first paragraph describes, in one sentence, the kind of in-person theft the New York law firm in the archive later told its extortionists it had suffered:

"The cyber threat actor Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, is targeting law firms using information technology (IT) themed social engineering calls, then sending an individual posing as an IT support employee to the firm in-person, after which they insert a storage device into a computer to steal sensitive data to extort the victims."

It says why: since spring 2023 the group has "consistently targeted US-based law firms, likely due to the highly sensitive nature of legal industry data." It says the tactic changed in April 2025, from fake subscription invoices to calls from someone claiming to be the firm's own IT department. It names the tools: Zoho Assist, Syncro, AnyDesk, Splashtop and Atera for access, WinSCP and a hidden or renamed copy of Rclone for exfiltration. It warns that the intrusions "leave few artifacts" and are unlikely to be flagged by traditional antivirus because the tools are legitimate.

And it says what to do. Verify the credentials of all individuals accessing firm spaces. Train staff to resist phishing. Develop and communicate policies on when and how the firm's IT will authenticate itself to employees. Keep backups. Turn on two-factor authentication for every employee.

Five recommendations, none of them expensive. The leaked chats begin three months later.

On May 26, 2026, the FBI issued FLASH-20260526-01, Silent Ransom Group Impersonating IT Personnel through Social Engineering. It is the same warning, a year later and more specific. The call now comes first, by phone or by a phishing email that urges the employee to call IT. "If that attempt fails, SRG sends a threat actor to the victim's location to gain access to insert a storage device into the victim's computer." The cover story is that the visitor needs to image the device or create a backup to deal with the phishing email. The FLASH adds Quick Assist and RustDesk to the tool list, names business-data-leaks[.]com as the group's leak site, maps the activity to nine MITRE ATT&CK techniques, and asks victims to hand over, among other things, "Identifying information of individuals posing as IT support, including surveillance videos and any photos provided."

Its recommendations build on the 2025 list. They add copying each visitor's ID card, limiting access to sensitive data from home and public networks, phishing-resistant MFA, blocking port 22 where possible, and, "if possible," disabling "remote access and external drive installation permissions on company computers with access to sensitive or confidential data." That last line is the control that turns an in-person visit into a wasted trip. It arrived a year after the first warning, and with a qualifier.

One thing neither document contains is worth naming. Neither notice says how many firms had already been hit, how many paid, or how many of the physical intrusions succeeded. The FBI asked victims for that information. The leaked ledger is, among other things, a version of the answer the Bureau was asking for.

The intrusion is a phone call with a script

Mandiant's June 5, 2026 report, Seeking Counsel, by Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer and Tyler McLellan, is the best technical account of how the group works, and the Luna Moth Files fill in the human side. Put together, the construction log looks like this.

The pretext email. A short, plain, invoice-themed message from a consumer email account, with no link and no attachment. Mandiant quotes one in full: "hello, here is the invcoie we talked about yesterday." It exists to make the next phone call plausible. Nothing in it trips a secure email gateway, because there is nothing in it.

The call. The caller poses as internal IT helpdesk or security staff, often targeting employees whose contact details are publicly listed. Pretexts are a security problem or a data migration project (T1566.004 Spearphishing Voice). Check Point's reading of the leaked vishing document adds a detail no outside report had: the caller is instructed to watch a separate group chat during the session and relay changes in the victim's behavior, which implies a second operator working the endpoint while the first keeps the employee calm. The script follows an arc of anxiety, reassurance and renewed urgency, with remote access framed as a protective security check.

The remote session. The employee is walked into a screen-sharing session and a remote management tool. Mandiant observed Zoom, Microsoft Teams, Terminal Services, Quick Assist, AnyDesk, Bomgar, Zoho Assist and SuperOps RMM (T1219 Remote Access Software). Installer links are sent through privnote[.]com, a self-destructing note service, so the link leaves no trace in browser history or chat logs. One staging command Mandiant published downloads an MSI with curl and installs it silently. In some cases the actors started a Zoom session on the employee's personal device and used it to reach the firm's virtual desktop through Windows 365 or Citrix (T1133 External Remote Services).

The search. This is where it stops being a generic intrusion and starts being a law firm intrusion. Mandiant saw the actors run keyword searches inside iManage, the document management system much of the legal industry runs on, for tax forms (W-2, W-9, 1099), audit files, client agreements and Social Security numbers. Results were staged in the user's Downloads or Roaming folders.

The exit. Browser uploads to consumer file-sharing accounts, sometimes in folders renamed to look like the victim's own branding (T1567.002 Exfiltration to Cloud Storage). Portable WinSCP or Rclone over SSH when the browser route is blocked. Email from the victim's own mailbox. In one incident Mandiant measured 1.7 GB to Google Drive followed by 14.4 GB over WinSCP. In many incidents the entire sequence, first contact to data theft to extortion, happened inside one business day. In some, the search, staging and theft took under an hour.

The visit. When the call fails, someone comes to the door (T1052.001 Exfiltration over USB). Mandiant assessed the physical intrusions the FBI described as likely this actor, short of formal attribution because forensic evidence was thin and no extortion followed in those cases. The leaked chats remove much of that doubt about intent, if not about results.

The demand. An unbranded email, a three-day clock, threats to contact employees and clients, and the leak site (T1657 Financial Theft).

None of this requires an exploit. There is no CVE to patch. Mandiant's own summary is blunt: targeting the human element with voice-guided social engineering lets actors walk past technical perimeters, "web security gateways, and MFA configurations." The control that fails is a person deciding, on the phone, that the caller is who he says he is.

The recruiting ads said nightclub promoter

The physical side of the operation is the part of the archive most likely to be misread, in both directions.

According to Crystal, field agents were recruited through Russian-language job ads for "nightclub promoters" in Miami, Orlando and New York, paying $300 or more a night, and then steered into office-intrusion work. Crystal compares the pattern to money-mule recruitment. The Record reports paid Telegram ads disguised as listings for nightclub promotion, courier work and security, a $3,200 printer with ultraviolet capability and other materials for forging ID cards, payments to a forger in New York, a roster of agents listed by number and city, and a channel name suggesting one agent was caught in Chicago. Ideas floated for getting inside included pizza-delivery ruses, IT-worker impersonation, masks modeled on lawyers and smart glasses for recording.

And then the numbers. In February the group's leader estimated that one recruit in ten was usable, a figure he called the "conversion" rate. Recruits vanished after being paid. Some backed out at the office entrance. S-RM's assessment is that the in-person program was immature and produced little revenue, that recruits dropped out, and that at least one was arrested.

The correct reading is this. The physical intrusions are real, the FBI has documented them twice, and at least one firm told its extortionists it knew someone had entered its office and copied files to a flash drive. They are also not where most of the money came from. The money came from the phone. A firm that spends the next month on lobby security and nothing on how its staff verify a caller who says he is from IT will have fixed the part of the attack that mostly failed.

The infrastructure points two ways

Our DNS observations and Mandiant's published indicators describe an operation with two very different footprints.

The part that touches victims is close to home. Four of the seven IP addresses Mandiant published sit in one US hosting provider, Hostwinds (AS54290); a fifth is in Comcast Cable's network, a sixth on a small US network, BL Networks; one is on a German host. Mandiant does not say what role each played, and its published installer command uses a placeholder rather than a real address. Mandiant also published the domain patterns the group registers for its callers: <organization>-itdesk[.]com, <organization>-it[.]com, <organization>-helpdesk[.]com. Any firm can watch certificate transparency logs and new registrations for its own name in those patterns, and block those specific IP addresses at the firewall, this week.

The part that faces the world is built to survive. The leak site's ten-address answer, half of it replaced within minutes across consumer providers in a dozen countries, behind nameservers on a domain registered in February 2026 that also resolve to consumer addresses, is a design choice. Fast-flux hosting exists so that no single provider can take the site down and no single address leads to the operators. The domain itself, registered in February 2024 and changed on October 9, has outlived two FBI notices, a Mandiant report and the leak of its operators' chats.

Two practical consequences follow for a firm on the wrong end of this. First, a promise that data will be deleted is a promise made by people who have built their publishing platform specifically to be unaccountable. Second, takedown is not a plan. If data is posted, it will stay posted for as long as the operators want it to.

The money left through Zelle and Russian bank cards

Crystal's tracing is the part of the story that should land on a bank's desk.

The operations lead set rules: a fresh address for every payout, one victim per wallet, no consolidation. Operators broke them. A recruiter spent two payouts in a single transaction on April 22, 2026, linking wallets that were supposed to stay separate. One source wallet received 13.23 BTC (about $898,000) and paid 0.735 BTC to the recruiter, matching a $1 million settlement claim in the chats.

Cash-out ran through instant exchangers paying out to Russian bank cards, often at Tinkoff, now T-Bank; through a Moscow over-the-counter cash courier known as "Zhenya," with a minimum of about $10,000, whom the chats suggest skimmed through the exchange rate; and through a Bitcoin-to-Zelle desk advertised on Telegram as @SAFUexchange, which Crystal links to an unlicensed, sanctions-flagged exchange in Georgia. Smaller payments to field agents and forgers went through regulated, identity-verifying exchanges, which Crystal calls the group's weakest point and the most direct route for law enforcement to put names to handles. When one exchanger flagged an "AML problem," a refund went out through a Wasabi CoinJoin address. One $4,000 payout was described in the chats as "93% dirty."

Then there is the spending. The chats discuss buying property in person, new-build homes and sports cars, using mortgages and premium private banking, and explaining the money as an inheritance, a gift or a fake loan agreement if a bank asks. One recruiter, Crystal reports, bought Russian property through a power of attorney and gave "savings" as the source of funds.

A Bitcoin-to-Zelle desk means some of the ransom paid by American law firms came back into the American banking system as person-to-person payments. Crystal's own guidance to banks names the signals: incoming Zelle or card payments tied to crypto-to-cash desks, property purchases with source-of-funds stories that do not match, and pressure to move into private-banking channels. A community bank or credit union reading this does not have a Silent Ransom Group problem. It may have a customer who is someone else's money mule.

Law firms were the first victims in 2022, and the warning has been public since

None of this is new, which is the problem.

On November 21, 2022, Kristopher Russo of Palo Alto Networks' Unit 42 published a threat assessment of a callback-phishing campaign that ran from mid-May to late October that year. The actor sent fake subscription invoices with a phone number to call, ran its own call centers on VoIP numbers, and used Zoho Assist, Syncro, Atera, Splashtop, Rclone and WinSCP. The first victims were small and medium-sized law firms. Demands ran from 2 to 78 BTC, sized to the victim's researched revenue, with discounts of about 25 percent for paying quickly. And, Unit 42 noted, paying did not guarantee the data would be deleted. Sygnia had named the actor Luna Moth. AdvIntel linked it to the Silent Ransom Group and to the remnants of Conti.

The lineage runs further back. Mandiant ties UNC3753's techniques to UNC2686, the BazarCall callback campaigns of early 2021, and records that the group deployed LockBit ransomware in 2022 before dropping encryption altogether. Around March 2025 it stopped posing as a software vendor and started posing as the victim's own help desk. The FBI observed the change by April 2025 and said so in May.

Law firms have known for even longer what is in their files and who wants it. On December 27, 2016, federal prosecutors in Manhattan unsealed charges against three Chinese nationals accused of hacking two law firms in 2014 and 2015, stealing the email of partners working on mergers, and trading on what they read for about $4 million in profit. The ABA Journal reported that the firms, unnamed in the indictment, were likely Cravath, Swaine & Moore and Weil, Gotshal & Manges. Then-U.S. Attorney Preet Bharara called the case "a wake-up call for law firms around the world."

In October 2018 the American Bar Association issued Formal Opinion 483 on lawyers' obligations after a data breach. As summarized by Professor David Hricik, it requires lawyers to "employ reasonable efforts to monitor" for unauthorized access to client confidences, and to give current clients whose information is compromised enough information "to make an informed decision as to what to do next, if anything."

And on February 20, 2024, when the UK's National Crime Agency took over LockBit's infrastructure, it reported what it found: "Some of the data on LockBit's systems belonged to victims who had paid a ransom to the threat actors, evidencing that even when a ransom is paid, it does not guarantee that data will be deleted." That is almost certainly the finding the New York law firm in the leaked chats had in mind when it cited LockBit's failure to delete data back to its own extortionists while offering them $1 million.

So the record, in order: a 2016 indictment alleging that law-firm email was stolen for the deals in it. A 2018 ethics opinion on what lawyers owe clients when it is stolen. A 2022 report showing this specific actor chose law firms first. A 2024 government finding that paying does not buy deletion. A 2025 FBI notice describing the exact technique and five controls that would blunt it. A 2026 FBI FLASH repeating it with more controls, and a Mandiant report with the indicators. And a leaked ledger that marks 27 victims as paid.

Two names are already in the public record

Most of the firms in the archive have not been publicly identified, and Cloudskope will not identify them from leaked material. Two have been named by other reporting, before the leak, and their public record is useful precisely because it shows what a firm's own disclosure looks like next to the group's.

Jones Day. In early April 2026, according to Reuters reporting summarized by Crowdfund Insider, the group posted information about a "handful of clients" of the firm on its leak site. Jones Day confirmed the breach and said all affected clients had been notified. That is the whole of the public account we could find: no date of intrusion, no method, no count.

Fox Rothschild. Bloomberg Law reported on June 9, 2026 that a woman had sued the firm in the Eastern District of Pennsylvania, alleging it failed to protect her data from criminals who may have taken her Social Security number, in an attack the firm dated to May 21. Bloomberg Law identified the attacker as the Silent Ransom Group, citing a public report by HookPhish. Reuters' October 8 story again lists Fox Rothschild and Jones Day among firms the group was allegedly involved in hacking.

Neither firm has said, publicly, whether it paid, and we are not suggesting either did. What the public record shows is the asymmetry the leak exposes. On one side, a confirmation, a notification letter and a lawsuit. On the other, a ledger with stages, prices and wallets. Clients of law firms are reading only the first column.

The next names on the list are not law firms

This is the part of the archive most relevant to Cloudskope's readers, and the part least covered.

S-RM reports that the chats show plans to expand into accounting, insurance, financial services and healthcare under a new brand, Sleepless Threat. The Record reports the same relaunch name was under discussion when the archive ends in September, along with a senior member's April statement that the "ultimate goal is to become a social movement or a cult." Crystal reports discussion of offering up to $100,000 to insiders at US defense-sector targets.

The expansion has partly happened already. The FBI's 2026 FLASH says the group has victimized companies in the insurance, finance and healthcare industries. Mandiant's January-to-May campaign covered "dozens of organizations" in professional, legal and financial services. Check Point's count of the broader victim set includes 22 finance classifications. The public tracker lists eight 2026 postings in financial services. And Mandiant's description of what the actors searched for inside law firm document systems (W-2s, W-9s, 1099s, audit files) is a description of what sits inside every CPA firm, wealth manager and family office in the country.

The technique transfers without modification. A tax practice in October has every employee waiting for something from IT. A registered investment adviser has a help desk outsourced to a managed service provider whose staff the advisers have never met. A community bank's branch staff are trained to be helpful on the phone. Each of those is the exact human condition the group's script is written for.

The people on your side of the table had a bad week too

The leaked negotiation shows a law firm doing what incident response retainers and cyber insurance policies tell it to do: bring in specialists, put a number on the table, demand proof of deletion. The same week the archive surfaced, charges against two more people from that specialist layer became public. Neither case has anything to do with the Silent Ransom Group. Both matter to any board that has outsourced the worst decision of its year.

MonsterCloud. On September 23, 2026, a grand jury in the Eastern District of New York indicted Zohar Pinhasi, 50, of Hollywood, Florida, owner of the ransomware recovery firm MonsterCloud, on one count of wire fraud conspiracy and two counts of wire fraud (case 26-CR-271). He was arraigned in Brooklyn on October 7, pleaded not guilty, and was released on a $2 million bond, according to BleepingComputer. Prosecutors allege that from June 2018 to June 2023 MonsterCloud, which marketed recovery "without succumbing to ransom demands," had no proprietary decryption technology, secretly paid the ransomware operators for keys, and billed clients far more. The Justice Department says he charged clients more than $19 million and paid more than $8 million in ransoms. In one August 2023 example he allegedly paid about $8,200 and charged about $150,000. In 2019, prosecutors say, when the company's own paid spokesperson asked whether it had proprietary decryption software, Pinhasi wrote: "Monstercloud doesn't hold any Proprietary technology [to] decrypt the ransomware data." ProPublica had reported the same business model in 2019, as BleepingComputer and The Record both recounted, after researcher Fabian Wosar and a colleague posed as ransomware victims and approached recovery firms. He is presumed innocent. BleepingComputer said it had contacted his attorneys, Christopher Clark and Rodney Villazor, for comment. As noted above, the claim is still on MonsterCloud's website.

Edward Dubrovsky. On October 8, the FBI arrested Edward Dubrovsky, 54 (spelled Dobrovsky in court records), in Pennsylvania, in connection with its investigation of the ShinyHunters extortion group. KrebsOnSecurity reports he is the author of a 252-page book on ransomware negotiation, that court records summarize the charges as conspiracy to threaten to impair the confidentiality of information with intent to extort and interference with commerce by threats, and that the core complaint and several other filings are sealed. The case was moved to the Eastern District of Texas. Cypfer, a Canadian negotiation firm he was associated with, says he was a managing director, not a founder, and resigned in November 2025; Krebs reports he is now associated with another Canadian firm, CyberSteward. The FBI, per Krebs, says ShinyHunters has extorted more than $70 million from victims this year. He is presumed innocent, and nothing public describes his alleged role.

DigitalMint and Sygnia. This one is already resolved. In May 2026 Ryan Goldberg, a former Sygnia incident response manager, and Kevin Martin, a former DigitalMint negotiator, were each sentenced to four years for acting as BlackCat ransomware affiliates against US companies in 2023, per BleepingComputer. In July, The Hacker News reported, a third, former DigitalMint negotiator Angelo Martino, received 70 months; he had negotiated for five ransomware victims while secretly passing BlackCat their confidential negotiating positions and insurance policy limits.

Put those three cases next to the law firm in the leak asking for proof of destruction, and the governance point is plain. The negotiators, recovery firms and incident responders who stand between a victim and an extortionist are vendors. They are picked under pressure, often from an insurer's panel, rarely diligenced, and given the most sensitive information the company has: what it can afford. In the past twelve months, people from that layer have been charged in three separate federal cases: one in which negotiators admitted acting as ransomware affiliates, one alleging an extortion conspiracy, and one alleging a firm lied to victims about paying the extortionists. A board that has never asked who is on its panel, and how they are paid, is trusting that layer on reputation alone.

What every firm holding deal data should have done by now

The controls are not a secret. Most are in the FBI's own notices.

1. Treat every inbound IT call as unverified. IT never asks an employee to install a remote tool on an inbound call. Any request is verified by hanging up and calling a number from the internal directory. Published, trained and tested with live calls. This is the FBI's 2025 recommendation, restated.
2. Allow one remote-access tool and block the rest. Application control (WDAC or equivalent) against AnyDesk, Zoho Assist, Quick Assist, RustDesk, Splashtop, Atera, Syncro, SuperOps and their portable versions, plus restricted remote-control features in Zoom and Teams. Mandiant's recommendation.
3. Turn off USB mass storage. On endpoints and on any personal device that reaches virtual desktops. The FBI's 2026 FLASH says to disable external drive installation "if possible"; Mandiant says to do it. The visitor with a flash drive becomes a visitor with nothing to do.
4. No technician without a ticket. Front desk staff confirm every service visit against a work order with the help desk, copy the visitor's ID, and escort. The FBI's 2026 FLASH asks for the ID copy by name.
5. Watch the document system. Alert on keyword-search spikes and mass downloads in iManage, SharePoint and similar systems, and require MFA step-up for document repositories and for personal devices reaching VDI.
6. Watch your own name. Monitor certificate transparency and new registrations for yourfirm-itdesk, -it and -helpdesk patterns, and block the specific IP addresses Mandiant published.
7. Decide the extortion response before the phone rings. Who calls clients, who calls the FBI, who decides about payment, what the engagement letters require, and how the ABA's notice obligations will be met. Rehearse data-theft extortion, not only encryption, as S-RM recommends.
8. If you were a victim, read your own file. S-RM advises former victims to review the leaked chats, through a specialist, for references to their organization. Do it through counsel. The FBI asked for exactly this information twice.

Eight things. Most of them cost staff time, not money. The FBI and Mandiant controls have been public for at least four months, and the first of them for more than sixteen.

What boards should be asking this week

For any company that sends confidential information to outside counsel, which is every company with a board, five questions for Monday.

First, which law firms, accounting firms and advisers hold our most sensitive documents right now: pending transactions, litigation, executive tax and compensation files? If nobody can produce that list in a day, that is the finding.

Second, has any of them told us about an incident this year? Our engagement letters should say when they must. Most do not.

Third, how does each of those firms verify a caller claiming to be from IT, and a technician at the front desk? The answer should be a written policy, not an assurance.

Fourth, who is on our own incident response and negotiation panel, who chose them, how are they paid, and has anyone checked them since the MonsterCloud indictment and the DigitalMint sentences?

Fifth, if our data appeared on a leak site tomorrow, who would tell us? Not the law firm, on the evidence of the leaked ledger, where most of the apparent payers have said nothing public at all.

For sponsors and acquirers

Deal teams diligence the target's controls and ignore the controls of the firms holding the deal. That is backwards. During a live process the most valuable copies of the confidential information memorandum, the disclosure schedules, the quality-of-earnings work and the management team's personal tax files sit at the sponsor's counsel, the target's counsel, the accountants and the bankers. The 2016 insider-trading case shows what an outsider can do with merger email. The leaked ledger shows what an extortion crew can charge for it.

This is materiality asymmetry in its plainest form. A breach at a law firm may never touch a disclosure threshold for the firm, which is a private partnership with no shareholders and no 8-K. The same breach can be material to a public client whose unannounced transaction sat in the stolen folders. The firm decides what to tell the client. The client's board carries the consequence.

The questions cost nothing. Ask outside counsel and accountants, in the engagement letter, to notify within a fixed number of days of any incident touching your matter, to describe in writing the controls they run against IT impersonation, and to confirm USB storage and unapproved remote tools are blocked on machines that touch your files. Ask the target in diligence which outside firms hold its sensitive data and whether any has reported an incident. Ask your own insurer who is on the negotiation panel.

A week to answer. More predictive than a SOC 2 report.

What we are not saying

We are not saying the Luna Moth Files are authentic in full; nobody has established that, and the group denies it. We are not saying any named firm paid the Silent Ransom Group, or that the $207 million figure is accurate; it is a tally of the group's own ledger entries, partly corroborated on-chain by Chainalysis and Crystal Intelligence. We are not saying that any law firm that filed a breach notice in California this year was a Silent Ransom Group victim; our count shows only that more law firms are filing. We are not saying Jones Day or Fox Rothschild paid anything. We are not saying MonsterCloud, Zohar Pinhasi, Edward Dubrovsky, Cypfer, CyberSteward, DigitalMint or Sygnia have any connection to the Silent Ransom Group or to any law firm in the archive; Pinhasi and Dubrovsky are presumed innocent. We are not saying the Russian state directs this group; the archive shows members discussing a Ministry of Defense buyer and contains no evidence of a relationship. We are not saying the internet providers whose addresses appear in the leak site's DNS are complicit; fast-flux networks typically run on devices their owners do not know are compromised. And we are not saying the physical-intrusion program succeeded at scale; the archive suggests it mostly did not.

We are saying that the FBI described this attack to law firms in May 2025, that the controls were public, that the group's own records claim it was paid dozens of times afterward, that it kept posting victims the week its books leaked, and that its stated next targets are the accountants, insurers and financial firms Cloudskope's readers rely on. If any firm, agency or person named here would like to correct the record, this page will be updated the same day.

Our record of these incidents

• Silent Ransom Group: The Luna Moth Files Leak, the verified timeline and running list of unknowns
• Fifteen Months, One Phone Call: How the Same Attack Went From Marks & Spencer to Apollo Global
• How a Phone Call Beats MFA: Anatomy of the Wall Street Vishing Wave
• Apollo. Blackstone. Bridgewater. Bain. The Same Crew Is Vishing Them All
• Three Breaches, Three Years: EY and the Client Tax Records
• Instructure Paid Off Its Hackers. The House Homeland Security Committee Wants to Know Why.
• Acquisition Agreements Get Signed on Cyber Reps Nobody Verified

Sources

• Federal Bureau of Investigation, PIN 20250523-001, Silent Ransom Group Targeting Law Firms, May 23, 2025
• Federal Bureau of Investigation, FLASH-20260526-01, Silent Ransom Group Impersonating IT Personnel through Social Engineering, May 26, 2026
• Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer and Tyler McLellan, Google Threat Intelligence Group / Mandiant, Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms, June 5, 2026
• Nicholas Smart, Crystal Intelligence, Inside the Silent Ransom Group leak: how ransoms were laundered, October 6, 2026
• Alexander Martin, The Record from Recorded Future News, Leaked chats show Russian extortion gang sending agents into US law firms, October 8, 2026
• AJ Vicens, Reuters (via Insurance Journal), Leak Exposes Payments to Hacking Group That Has Extorted Law Firms, October 8, 2026
• Connor Jones, The Register, Money trail backs leaked chats from extortion crew that walks into US law firms, October 8, 2026
• Uriel Sigal, Check Point, Luna Moth Files: How Silent Ransom Group Operates, October 9, 2026
• Virginia Romero Sanchez-Herrero, S-RM, Cyber briefing note: The Luna Moth files, October 9, 2026
• Dissent, DataBreaches.net, Silent Ransom Group claims "Luna Moth Files" are fake. The data suggest otherwise., October 9, 2026 (updated October 10)
• Kristopher Russo, Palo Alto Networks Unit 42, Threat Assessment: Luna Moth Callback Phishing Campaign, November 21, 2022
• U.S. Attorney's Office, Eastern District of New York, Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients, October 7, 2026
• Lawrence Abrams, BleepingComputer, Ransomware recovery CEO charged over secret ransom payments, October 7, 2026
• Jonathan Greig, The Record, DOJ charges ransomware recovery CEO for secretly paying hackers, October 8, 2026
• Brian Krebs, KrebsOnSecurity, FBI Arrests Executive at Ransomware Negotiation Firm, October 9, 2026
• U.S. District Court, Eastern District of Pennsylvania, United States v. Dobrovsky, No. 2:26-mj-01973 (docket via CourtListener), October 8 and 9, 2026
• BleepingComputer, US ransomware negotiators get 4 years in prison over BlackCat attacks, May 2026
• The Hacker News, Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks, July 10, 2026
• Ufonobong Umanah, Bloomberg Law, Fox Rothschild Sued After SilentRansomGroup Cyberattack, June 9, 2026
• JD Alois, Crowdfund Insider, Silent Ransom Group Reveals Hacked Jones Day Data, April 7, 2026 (citing Reuters)
• ABA Journal, Alleged BigLaw hackers made $4M trading on stolen information, federal prosecutors say, January 3, 2017
• National Crime Agency, International investigation disrupts the world’s most harmful cyber crime group, February 20, 2024 (as republished by GlobalSecurity.org)
• David Hricik, Patently-O, ABA Issues Opinion on Lawyers’ Obligations after Electronic Data Breach, October 2018 (on ABA Formal Opinion 483)
• Ransomware.live, Silent Ransom Group tracker page (API queried October 11, 2026)
• California Department of Justice, Data Security Breach Reports (full export downloaded October 11, 2026)
• MITRE ATT&CK, T1566.004 Spearphishing Voice, T1219 Remote Access Software, T1133 External Remote Services, T1567.002 Exfiltration to Cloud Storage, T1052.001 Exfiltration over USB and T1657 Financial Theft