Silent Ransom Group (Luna Moth): Data Theft Without Encryption

Silent Ransom Group — also tracked as Luna Moth, Chatty Spider and UNC3753 — grew out of the Conti ransomware operation. Its leak site had listed 154 victims by late September 2026, 17 of them in the previous 30 days (ransomware.live). About three-quarters are in the US, and half are in professional services, law firms above all.

The group does not deploy an encryptor. It gets in by talking to people: earlier campaigns sent fake subscription invoices with a phone number to call to "cancel", and since 2025 the FBI has warned that it phones employees directly while posing as the company's own IT department. The employee is talked into installing a legitimate remote-access tool, the attackers copy files out, and an extortion demand follows with the threat of publishing client data.

There is nothing to decrypt, so the questions are different: what was taken, from which machines and through which account. Answering them takes forensic work on the affected computers — remote-tool logs, file-access history and evidence of transfers — preserved before those machines are wiped or reimaged. For a law firm or accountant, that evidence is also what regulators, insurers and clients will ask for.

The real defence is simple and worth repeating to staff: your IT team will never ask you to install remote-support software because of a call you did not expect.