INVESTIGATION08 OCT 2026

Inside the
Silent leak

5,692 internal messages expose an extortion operation built around law firms, phone deception, physical access and a claimed $206.95 million in payments.

Read the investigation Browse the archive

Primary sourceChat export and supplied exhibits External supportFBI, blockchain analysis and reporting Attacker claimUnverified statements in the archive

01Key findings

$206.95M

A sales pipeline for extortion

Organizations moved through named stages: LOADING, CHAT, OFFER, CONTRACT and GOLD. The archive records 27 GOLD entries from April to September 2026.

How the intrusions worked

The documented 2026 campaign centered on social engineering and legitimate access tools, not exploitation of zero-day vulnerabilities.

01Targeting and pretextResearch an employee, then call or email while posing as internal IT.

02ARemote routeConvince the employee to open a support session or install a legitimate RMM tool.

02BPhysical routeIn some cases, send an impostor into the office to connect removable storage.

03Data theftCopy files through cloud storage, WinSCP, Rclone, USB or an external drive.

04ExtortionDemand payment while threatening publication, sale, and direct contact with clients or employees.

The physical route is confirmed as an SRG tactic by the FBI. Individual plans and success claims in the leaked chats are not all independently verified.

02How the operation evolved

03The money

ATTACKER LEDGER

$206,950,000

Sum of the 27 latest values marked GOLD in the export. Names and values reproduce the attackers' internal labels and do not establish that each payment occurred.

What the blockchain shows

Crystal traced about 37 BTC through wallets named in the chats and found timing consistent with several entries. A collection wallet further upstream received about 2,675 BTC over its lifetime. This supports scale and method, not each victim amount.

Organization label	Date	Claimed amount	Evidence

1Collection walletsLarge upstream balances

2Single-use walletsOne claimed victim per address

3Shares and contractorsSmall payments to participants

4Cash-outCards, cash, Zelle and exchanges

04Case files

05Explore the chat archive

5,692 messages. 36 room IDs. One searchable record.

Messages are translated automatically into the selected language. The original Russian or English text remains available at any time. Credentials, personal contact details and operationally dangerous passages are redacted.

06Method and limits

Sources

Crystal IntelligenceWallet tracing and laundering analysis, 6 October 2026 Recorded Future NewsIndependent reporting on the leaked chats, 8 October 2026 ReutersReporting on the anonymous publication of The Luna Moth Files, 7 October 2026 FBI FLASH-20260526-01Official advisory on social engineering and in-person intrusion Google Threat Intelligence / MandiantTechnical analysis of the 2026 social-engineering campaign ZeroFox IntelligenceAnalysis of physical intrusion tradecraft, 1 June 2026 DataBreaches.netReporting on the claimed $207 million total

SHA-256Loading...