Leaked chats show an extortion crew posing as IT staff at law firms

GuidePoint Security's research team published on 15 October 2026 an analysis of 5,692 chat messages from two self-hosted Rocket.Chat servers, covering 27 August 2025 to 29 September 2026. GuidePoint received a copy on 6 October and assesses with moderate-to-high confidence that the participants operate under or alongside the Silent Ransom Group (SRG) name; the chats also show a planned rebrand to Sleepless Threat.

No CVE identifier appears in the messages and the group deployed no malware. Instead, operators telephoned employees while posing as the firm's own IT department, then sent a person to the office to plug in a storage device carrying ordinary remote-access software. The targets were large law firms: 20 per-firm rosters posted between 30 July and 4 September 2026 list senior partners and executives, and 13 of them include the firm's own cyber or privacy partners.

The group's internal records claim $206.95 million in payments from 27 organizations between 3 April and 24 September 2026; GuidePoint stresses these are the actors' own figures, not verified on-chain. The chats also describe helpers in the United States recruited through ordinary job ads and given forged identification.

Why it matters This is an intrusion without an exploit. The controls that count are verification of internal IT calls, control of who enters the office and what gets plugged in, and a plan for the moment an extortion call reaches a partner directly, since the rosters show the crew calling the people most likely to run the response.