Signalis
sign in--:--:--UTC
Threat actors

Silent Ransom Group

☆ pin
MITRE G1016Also known as Silentransomgroup, UNC3753, CHATTY SPIDER, Luna Moth, Chatty Spider, Silent Ransom Group, SRG, Storm-0252
Reports
56
First seen
May 13, 2026
Last seen
Oct 9, 2026
Motivation
Financial

Targeting

Sectors
Professional Services ×23Financial Services ×1
Victim regions
×20
×20
United States×20

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1005 Data from Local System ×6T1598 Phishing for Information ×6T1566 Phishing ×6T1566.002 Phishing: Spearphishing Link ×5T1041 Exfiltration Over C2 Channel ×4T1021 Remote Services ×4T1219 Remote Access Software ×3T1598.003 Phishing for Information: Spearphishing Link ×3T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×3T1021.001 Remote Services: Remote Desktop Protocol ×3T1204.001 User Execution: Malicious Link ×2T1589 Gather Victim Identity Information ×2

Indicators

domain ×56filename ×3cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-8398 (exploited)

Recent reports

High

Silentransomgroup claims O'Hagan Meyer in ransomware attack

ransomware.liveHigh

Silentransomgroup claims Baker McKenzie as ransomware victim

ransomware.liveHigh

Silentransomgroup publishes Andersen Group Inc. as ransomware victim

ransomware.liveHigh

Leaked chats reveal Russian extortion gang's US physical infiltration operations

The Record (Recorded Future News)Medium

Silentransomgroup publishes new ransomware victim

ransomware.liveHigh

Silentransomgroup publishes Andersen Group as ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new ransomware victim

ransomware.liveHigh

Silentransomgroup publishes Nelson Mullins Riley & Scarborough as ransomware victim

ransomware.liveHigh

Silentransomgroup publishes Sheppard, Mullin, Richter & Hampton as ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveHigh

Silentransomgroup publishes Clark Hill as ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new ransomware victim

ransomware.liveHigh

Silentransomgroup claims breach of Cozen O'Connor

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveHigh

Silentransomgroup claims Hogan Lovells Cadwalader victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new ransomware victim

ransomware.liveHigh

Silentransomgroup publishes Katten Muchin Rosenman as ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveHigh

Silentransomgroup claims Greenberg Traurig victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveHigh

Silentransomgroup claims Holland & Knight victim

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.liveMedium

Silentransomgroup publishes new ransomware victim

ransomware.liveMedium

Silentransomgroup publishes new victim on ransomware.live

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans