A newly surfaced archive of the Silent Ransom Group’s internal chats suggests the crew pulled in about $207 million over six months without deploying a single piece of malware.
The group’s model is pure social engineering. Rather than encrypting files, its operators pick up the phone and talk their way into victim organizations, leaning heavily on law firms. The leaked data, drawn from two of the group’s servers, covers roughly 13 months from August 2025 to September 2026 and holds 5,692 chat messages covering ransom negotiations, access methods, and planned targets.
Researcher Tammy Harper shared the leak as an onion site, according to reporting on the archive. The messages document payment discussions and the group’s approach to gaining a foothold at victims.
For defenders, the takeaway is that extortion does not require ransomware at all. Voice-based attacks bypass endpoint tooling and encryption entirely, so the controls that matter are identity verification for help-desk staff, callback procedures for urgent requests, and staff who know that a persuasive caller is a threat signal rather than just an annoyance.
Law firms remain a favored target because they hold confidential client material that carries its own leverage, independent of any operational disruption.
