A reported leak has prompted fresh scrutiny of Silent Ransom Group (SRG), also known as Luna Moth. Check Point says an anonymous onion site has claimed to publish chats, screenshots and other material describing a segmented workflow: target research, callers posing as internal IT, technical operators managing remote access and negotiators handling extortion.
Check Point describes that purported archive as unverified. Its publisher and provenance are unknown, and the material contains inconsistencies, including conflicting message totals and a headline financial figure that does not reconcile with the source’s own table. The archive should therefore be treated as reported context rather than established fact.
The FBI and Mandiant independently corroborate the underlying tradecraft: vishing and social engineering, impersonation of IT personnel, remote or screen-sharing access, data exfiltration and extortion without reliance on traditional ransomware encryption. The FBI says SRG has targeted US-based law firms since spring 2023, while Mandiant describes a 2026 campaign affecting professional, legal and financial-services organisations.
One statistic needs careful handling. Check Point’s 42-of-50 figure refers to recently observed victims in its own dataset; it does not establish a universal law-firm victim count or the share of all SRG attacks affecting law firms.
For legal employers, the evidence supports an operational lesson: staff able to authenticate IT requests, resist vishing and report suspicious access remain important. It does **not** establish a recruitment crisis, a universal law-firm victim count or a hiring-volume trend.