Silent Ransom Group, a data-theft extortion crew that goes after law firms, has listed Atlanta-headquartered Smith, Gambrell & Russell, LLP (SGR) on its leak site. The listing appeared on November 5, 2026. Trackers that scrape leak sites quote the post as saying "They offered $272.500 to keep the data from being published." Smith, Gambrell & Russell has not commented. No regulator filing or breach notification has been published, and no researcher has independently checked the claim. For now this is an attacker's claim. Nobody has confirmed a breach.
What Happened
Leak-site trackers recorded the listing late on November 5, 2026. HookPhish and QPulse both give the discovery time as 22:35 UTC. Ransomware.live, Nightwatch News, RedPacket Security and Breach House all indexed it the same day. The threat-intelligence firm ThreatMon put out an alert on November 6, which Undercode News reported. ThreatMon called it an "unverified ransomware victim claim" and said independent confirmation had not been established.
Accounts of the listing differ in three ways:
- What the dollar figure means. The leak post's own wording, as quoted by Ransomware.live and HookPhish, says the firm offered $272,500 to stop publication. That would suggest negotiations took place, which the group may be stating to pressure the firm. QPulse describes the same figure as a ransom the group demanded. Neither version can be checked. Undercode News also ran a headline giving the amount as "72,500", but the body of that article says $272,500.
- Which group posted it. Most trackers credit Silent Ransom Group. A separate Undercode News article names the poster as "LeakedData". No other tracker uses that name.
- Whether anything was published. Breach House marks the listing as "leaked" and says it captured a screenshot from the leak site. Undercode News reports that no data samples have been verified. The size and contents of any published material are unknown.
ThreatMon also flagged a second, partly redacted victim ("W… R…") at about the same time. Undercode News says there is not enough information to tell whether the two listings are linked. Undercode News also reports that SGR disclosed data security incidents in 2021 and 2024. Nothing shows that either one is connected to this claim.
What Was Taken
Nobody knows. No tracker reports a data volume, file count or sample. Breach House lists the leak status as "leaked", but no outlet has described what the files contain.
Undercode News says Smith, Gambrell & Russell provides legal and advisory services, including to clients in regulated industries. If the claim is real, the data most at risk would be the material law firms usually hold: privileged attorney-client communications, litigation files, documents from corporate deals, and personal data belonging to clients and staff. A breach at a law firm can expose many unrelated client organisations at the same time, so the people affected could reach well beyond the firm. Until SGR or a regulator says otherwise, treat all of this as possible exposure, not confirmed loss.
Why It Matters
This listing fits what the group is known for. Yaamlabs, writing about a leak of the group's internal chats in October 2026, says most of Silent Ransom Group's victims are US law firms, with insurance, finance and healthcare companies also hit. The group is also tracked as Luna Moth, Chatty Spider and UNC3753, and Yaamlabs describes it as Russia-based.
The leaked chats, published under the name "The Luna Moth Files", contain 5,692 messages written between August 2025 and September 2026. Yaamlabs says they show a structured operation that moves each victim through stages labelled "chat", "offer", "contract" and "gold", where "gold" means the victim paid. The chats claim about $207 million collected from 27 firms between April and September 2026. Crystal Intelligence could not verify that total. Chainalysis matched some of the wallets in the chats to addresses it already linked to the group's extortion. One of those wallets was funded entirely by a single victim payment of more than $10 million in mid-2026. Chainalysis said it could not vouch for all the claims in the archive.
The "offered $272,500" wording on the SGR post fits that sales-style process: the group publicises negotiation details to push the victim toward paying. Defenders should read the number as pressure on the firm, not as a fact about what SGR did.
The Attack Technique
No tracker reports how the group got into Smith, Gambrell & Russell, and none mentions a CVE. QPulse says no technical details have been disclosed.
Yaamlabs describes the group's usual method. It does not deploy encryption. Instead:
- Operators phone employees while posing as the company's IT department. This is known as callback or voice phishing.
- They talk the employee into starting a legitimate remote support or remote access session.
- Through that session they copy data out of the network.
- They threaten to publish the data on their leak site unless the victim pays.
No systems are encrypted, so a victim may not notice anything is wrong until the extortion demand arrives. Backups do nothing to stop the threat to publish. Whether SGR was targeted this way has not been established.
What Organizations Should Do
- Lock down remote support tools. Allow only one approved remote access product, block installation and execution of all others through application control, and alert on any new remote support binary or session that starts outside a ticketed IT request.
- Make sure staff can verify IT calls. Tell staff that IT will never cold-call and ask them to install software or start a session. Give them a callback number or internal channel they can use to check any request, and run voice phishing drills, not just email ones.
- Watch for large outbound transfers. Alert on unusual volumes leaving document management systems, file shares and endpoints, especially to cloud storage or file transfer services, and especially during or soon after a remote support session.
- Restrict access to client files. Use matter-based access controls so one compromised employee account cannot reach the firm's entire document store.
- Plan the client notification process now. Law firms owe duties to clients as well as to regulators. Decide in advance who handles legal privilege questions, client notifications and state breach notification deadlines if stolen data is published.
- Monitor leak sites for your firm and its vendors. Track leak-site listings that name your organisation, your outside counsel and your key suppliers, so you hear about a claim before your clients do.
Sources: Silentransomgroup Targets Smith, Gambrell & Russell, LLP in Ransomw... | Smith, Gambrell & Russell, LLP — SILENTRANSOMGROUP Ransomware Attac... | Extortion Group Claims 72,500 Payment Offer from US Law Firm Smith,... | Silent Ransom Group Claims Smith, Gambrell & Russell LLP as New Ran... | Silent Ransom Group chat leak: what defenders should check Yaamlabs | Smith, Gambrell and Russell, LLP Data Breach: Silent Ransom Group R... | 🏴☠️ Silentransomgroup has just published a new victim : Smith, Gam... | RedPacket Security: "SILENTRANSOMGROUP - Ransomwa…" - Mastodon.social