An unidentified source posted thousands of internal chat messages to a .onion site in early October, according to Recorded Future News. The messages, dated from August 2025 to September 2026, appear to show members of the Silent Ransom Group — also tracked as Luna Moth and Chatty Spider — discussing plans to send operatives into U.S. law firms, kidnap executives, and recruit military personnel to spy on submarine-based nuclear forces. Recorded Future News said it could not verify whether the most extreme schemes were attempted, but blockchain analysis firm Chainalysis tied cryptocurrency addresses in the leak to known Silent Ransom Group extortions, while cautioning that it could not speak to the totality of the claims.
Physical infiltration was a recurring theme. The FBI had already issued a flash alert warning that group members were posing as IT personnel to gain access to computers. In the chats, members brainstormed pizza-delivery ruses, custom masks modeled on real lawyers, and smart glasses for an agent posing as a client. One negotiation described in the archive involved a law firm saying an individual had entered its New York office and copied files onto a flash drive; the firm offered $1 million but wanted proof that all copies would be destroyed, citing LockBit's failure to delete data for victims who paid.
The group recruited its 'agents' through paid Telegram advertisements disguised as ordinary job listings, such as nightclub promotion, courier work, and security, apparently targeting Russian-speakers. The recruitment process was messy: one roster listed a 17-year-old as ready to work, another channel name suggested an agent had been caught in Chicago, and the group's apparent leader estimated that only one in ten recruits proved usable. Victims were managed like a sales pipeline, with entries moving from 'chat' to 'offer,' 'contract,' and 'gold.' The archive records roughly $200 million in claimed settlements across about 50 organizations, mostly law firms, though those figures are the group's own and could not be independently verified.
Other conversations described coercive tactics, including photographing a target's school-age child as leverage, a fake escort website, sexual blackmail, kidnapping, and a 'punishment' group to intimidate agents or people accused of cheating the group. Recorded Future News noted that the archive mixes apparent records of real extortion with brainstorming, abandoned plans, boasting, and violent fantasies, and that some named organizations have not publicly acknowledged a breach.