SilentRansomGroup

Silent Ransom Group (SRG), also known as Silent Ransom, Luna Moth, CHATTY SPIDER, UNC3753, STORM-0252, and LeakedData, is a financially motivated cybercriminal group active since at least 2022. Its operations focus on data theft and extortion rather than file-encrypting ransomware. Targets include law firms, corporate litigation and mergers-and-acquisitions advisory practices, and tax and financial advisory organizations, with victims in the United States and United Kingdom. The group seeks sensitive client records, privileged communications, confidential transaction information, intellectual property, and litigation strategies. The group uses social engineering, including invoice-themed callback phishing and voice phishing, to obtain access. Its impersonation techniques pressure employees or helpdesk personnel into authorizing remote access or changing identity controls. Operations abuse legitimate remote administration products, including Syncro, Splashtop, AnyDesk, and Atera, to control compromised systems while reducing reliance on overtly malicious tooling. Attackers enumerate internal resources and use Rclone to exfiltrate documents to cloud storage. Silent Ransom Group demands payment to prevent disclosure of stolen information and operates a public data-leak site to pressure victims. Its extortion activity includes victim listings, publication countdowns, and threats to release confidential records. Although frequently categorized alongside ransomware groups, its established extortion model does not require encryption.