Luna Moth Files: Silent Ransom Group chats and the $207 million

On Tuesday, 6 October 2026, an archive of internal chats attributed to Silent Ransom Group (SRG, also known as Luna Moth) appeared on a purpose-built onion site called “Luna Moth Files”. The figure that made headlines is the group’s own ransom ledger: $206.95 million paid by 27 organisations in about six months, without encrypting a single file. This is criminal bookkeeping, not verified data: none of the organisations listed has confirmed the amounts.

What happened

The archive was first reported to DataBreaches.net, according to Security Affairs by researcher Tammy Harper. Who published it is unknown. The group agreed to an interview with DataBreaches.net, but denied any breach and called the files fake. DataBreaches.net then published two follow-ups, on 9 and 11 October: according to the outlet, the data indicate the archive is genuine, and the leak did not come from a cyberattack against the group but from other circumstances.

What the archive contains and what is verified

According to Insicurezza Digitale and Security Affairs, the archive holds 5,692 messages from two servers, from 27 August 2025 to 29 September 2026: negotiations with victims, access methods, new attacks, and the split and conversion of proceeds.

In the internal ledger, the “GOLD” status marks a payment received. The 27 entries marked this way fall between 3 April and 24 September 2026, with a median of $6 million, a mean of about $7.66 million and amounts between $100,000 and $30 million. The sources differ on the scope: Security Affairs says all 27 victims are law firms, while Insicurezza Digitale speaks of 27 organisations and describes law firms as a preferred target.

The available corroboration is partial:

• On-chain analysis. Crystal Intelligence found transactions consistent with some chats. The wallets it analysed directly received about 37 BTC (around $3 million), mostly operator shares; a collection wallet reportedly received 344 BTC in six weeks between April and May 2026. According to Crystal, the data confirm the order of magnitude, not the individual ransoms or the total.
• Breach notifications. For 9 of the 27 organisations there are public incident disclosures with matching timelines: this corroborates that incidents occurred, not the payments.
• Inconsistencies. DataBreaches.net, quoted by Security Affairs, found entries on the group’s leak site that do not match the chats: in one case an offer with no trace of the “GOLD” payment, in another no reply at all from the victim in the conversations.

Technical details: extortion without malware

SRG, which emerged after Conti broke up according to Insicurezza Digitale, runs pure data extortion: it gets in, steals information and threatens to publish it, with no encrypting ransomware. The vector is social engineering:

• callback phishing: fake invoices that push the victim to call a number controlled by the group;
• fake IT support calls to convince employees to grant remote access;
• office visits under false identities, according to Crystal’s analysis as reported by Insicurezza Digitale;
• in one publicly disclosed incident, cited by Security Affairs, the attacker posed as internal IT and convinced an attorney to upload files to an external Google Drive; in another, an employee was deceived into handing over their credentials.

In our reading, the techniques described map to these MITRE ATT&CK entries: Spearphishing Voice (T1566.004), Impersonation (T1656), Remote Access Software (T1219), Valid Accounts (T1078), Exfiltration to Cloud Storage (T1567.002) and Financial Theft (T1657). There are no CVEs and no malware to catch with signatures.

The chats describe rules against tracing the proceeds (a new address for every payment, victims’ funds kept apart), not always followed: on 22 April 2026 a recruiter spent two separate payouts together, linking them on-chain. Cash-out ran through exchangers paying out to Russian bank cards, a cash courier in Moscow, a Bitcoin-to-Zelle service and, according to Security Affairs, a mixer whenever funds were flagged. Many smaller payments went to regulated exchanges, with accounts tied to verified identities: according to Crystal, the network’s weakest point.

The indicators from the archive, which Insicurezza Digitale is collecting on its forum, should be used as context: appearing in the leak does not prove use in attacks.

Impact for European and Italian companies

Law firms, accountants and consultants hold confidential client data, and the threat of publishing it creates enormous reputational pressure: that is what makes ransoms of this size possible without locking a single server. Professional firms are generally not NIS2 entities, but many of their clients are and, under Italy’s Legislative Decree 138/2024, must assess the security of their suppliers. Under the GDPR, theft of personal data must be assessed for notification to the supervisory authority within 72 hours, whether or not a ransom is paid.

The case also shows the limits of classic technical controls: if an employee opens the access or uploads the files, antivirus and EDR may see nothing unusual.

What to do now

1. One simple rule for everyone: IT never asks you to install remote access tools, hand over credentials or upload files to external cloud storage during an inbound call. Every request is verified by calling back a number already in the directory.
2. Invoices with numbers to call: the finance team must know that unexpected renewals and charges are a typical callback phishing lure.
3. Allow only approved remote access tools and alert on every new installation or execution of this kind of software.
4. Block or monitor uploads to personal cloud storage and large outbound transfers, especially from client folders.
5. Verify the identity of anyone who shows up at the office as a technician or supplier, with confirmation from an internal contact before granting access to workstations or the network.
6. If you are extorted, verify before negotiating: use the logs to reconstruct what actually left and involve lawyers and authorities right away.

How ARXDOME helps

ARX Sentry collects the software and process inventory of every computer and, in the SOC identity pages, shows remote desktop logons, night-time logons and account changes: a remote access tool that appears after a phone call is visible. ARX Shield lets you isolate a suspicious machine from the network with one click, ARX Trace collects the evidence to reconstruct what was taken, and ARX Expose flags look-alike domains and company accounts exposed in breaches, which help anyone preparing an impersonation.

Last updated: 11 October 2026