CyberNew CyberNew
Data Breaches & Leaks The Record 1 week ago

Leaked chats show Russian extortion gang sending ‘agents’ into US law firms

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Data & Identity Stores
Intelligence Sector
Data Breaches & Leaks

Analyst Takeaway

"Leaked chats show Russian extortion gang sending ‘agents’ into US law firms The archive, posted to a bespoke .onion site in early October by an unidentified source who did not state a motive, contains thousands of messages from August 2025 to September 2026. In those messages, members track dozens of victims, haggle over multimillion-dollar payments and direct operatives based in the United..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
silent ransomware

Leaked chats show Russian extortion gang sending ‘agents’ into US law firms

Members of a Russia-based cyberextortion gang plotted to send operatives into U.S. law firms, kidnap business executives and even recruit military personnel to spy on submarine-based nuclear forces, according to leaked chats reviewed by Recorded Future News.

The archive, posted to a bespoke .onion site in early October by an unidentified source who did not state a motive, contains thousands of messages from August 2025 to September 2026.

In those messages, members track dozens of victims, haggle over multimillion-dollar payments and direct operatives based in the United States whom they call “agents.” Some of the named organizations have not publicly acknowledged a breach.

The archive mixes apparent records of real extortion with brainstorming sessions, abandoned plans, boasting and violent fantasies. Recorded Future News could not verify whether the most extreme schemes were ever attempted.

However, parts of the cache have been corroborated independently. Blockchain analysis firm Chainalysis examined cryptocurrency addresses contained in the leak and said it could tie them to known extortions by the Silent Ransom Group, which is also tracked as Luna Moth and Chatty Spider. The company cautioned that it could not “speak to the totality of claims” documented in the archive.

The FBI has also documented the group's most unusual tactic for a Russian extortion group: recruiting what the gang calls “agents” to physically infiltrate victims' offices. A flash alert earlier this year warned that members of the Silent Ransom Group were posing as IT personnel to gain physical access to computers.

In one negotiation shared in the chats, a law firm's representative told the extortionists that the firm knew an individual had entered its New York office and copied files onto a flash drive.

The firm said its executives had authorized $1 million to settle the demand but wanted proof that every digital and physical copy of its information would be destroyed, citing evidence that the LockBit ransomware gang had failed to delete data belonging to victims who paid.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →