Alleged internal chats from Silent Ransom Group suggest it collected $206.95 million from 27 firms in roughly six months without encrypting a single file, according to Cyber Security News. The figures are unverified, and the group denies breaching its own systems or leaking the chats. The method matters more than the number: steal data, then threaten to publish it. Nothing crashes, so nothing looks wrong. If your firm holds client data, this post covers how the attack works, why tool-led defence struggles with it, and what to ask a 24/7 detection and response provider before you sign.

What the leaked chats claim, and what they don’t prove

DataBreaches.net reported the alleged leak on 7 October. It contains 5,692 messages dated between 27 August 2025 and 29 September 2026. Adding up the entries marked as completed deals gives the $206.95 million total, with a median alleged payment of $6 million. DataBreaches notes it has no confirmation from victims that the group carried out the attacks or that they paid the listed amounts.

Blockchain analysts have corroborated parts of the archive. Crystal Intelligence traced one collection wallet that received about 344 bitcoin, roughly $27 million, over six weeks in April and May 2026. It could not verify the headline total. The Register reports that Chainalysis found some leaked wallet addresses sit downstream of millions of dollars in payments extorted by the group. The evidence shows significant money moving, not that the headline total is accurate.

Law firms are the group’s main focus because they hold confidential client records. The FBI says the group has consistently targeted US-based law firms since spring 2023, and Mandiant, part of Google Cloud, describes dozens of US legal, professional and financial services victims between January and May 2026. Public reporting so far centres on US firms, but UK firms hold the same kind of data.

How a silent extortion attack works

Silent Ransom Group, also tracked as Luna Moth, Chatty Spider and UNC3753, has been active since at least March 2022, according to Mandiant. It deployed LockBit ransomware in 2022 but has since focused on stealing data and extorting victims without encrypting anything.

A typical intrusion, as described by the FBI and Mandiant, runs like this:

1. A short, invoice-themed email, often with no links or attachments, sets up a pretext.
2. A caller posing as internal IT or security support persuades the employee to start a screen-sharing session or install a remote support tool such as Quick Assist, AnyDesk or Zoho Assist.
3. The operator, or the employee acting on instruction, searches for sensitive files and copies them out using WinSCP, Rclone or uploads to a cloud drive.
4. An extortion email follows, often within 30 minutes of the attacker leaving, with a three-day deadline and threats to contact staff and clients and to publish the data on a leak site.

If remote access fails, the FBI says the group has sent someone to the office to copy files onto a USB drive. Mandiant assesses these visits as likely linked to the group but could not formally attribute them.

It is not the only group working this way. Smarttech247’s team recently profiled FulcrumSec, active since September 2025, with roughly 25 claimed victims across 11 countries. It uses no ransomware or encryption. It harvests exposed credentials and API keys from code repositories, clones data over weeks or months to avoid triggering alerts, and uses large language models to mine the stolen data and draft negotiation messages. Its listed incidents include a breach of a UK airports group. Smarttech247’s Scattered Spider spotlight describes a similar help-desk approach.

Why antivirus and alerts alone miss it

The FBI says recent campaigns left few artifacts on compromised machines, and that traditional antivirus is unlikely to flag them because the group generally uses legitimate remote access tools. It also warns that using those tools is not proof of attack on its own. Context is needed to tell an approved session from a hostile one. Smarttech247’s own FulcrumSec analysis makes a similar point about its zero-malware model: there is no executable for EDR or antivirus to detect. And Eddie Skraba, Smarttech247’s global director of threat intelligence, noted in a 2025 identity webinar that abused logins are not malware, so signature-based tools cannot simply spot them. The realistic defence is behavioural analysis.

The signals are also scattered. A failed Entra ID login, an odd VPN session or a new remote tool may mean little alone. Correlated in one place, they can trigger a suspicious-event alert. In the words of CrowdStrike’s Alex Bacik, speaking in an April 2026 Smarttech247 webinar, “siloed tools are the enemy”. Smarttech247’s MDR guide puts it more bluntly: “Detection without investigation is just noise.”

A system that still works is not evidence that the files are safe.

What should 24/7 detection and response cover?

Genuine 24/7 detection, investigation and response means analysts investigate alerts around the clock, not just forward them. The provider should hold pre-agreed authority to act, such as isolating a device or disabling an account, with a named human to escalate to when something serious happens. Ask for measured response times and run a realistic after-hours incident before you sign. Attacks that use valid logins and no malware need behavioural detection, not signatures.

Gartner’s Market Guide for Managed Detection and Response, published on 9 September 2026, defines MDR as remotely delivered, human-led and AI-augmented security operations that disrupt and contain attacks. It lists three mandatory features:

• A provider-hosted, provider-operated technology stack that coordinates real-time detection, investigation and active response.
• 24/7 staffing that understands your specific risks, works with your data daily and has skills in monitoring, hunting, threat intelligence and remote response.
• Immediate remote response and containment, such as quarantining a host, that goes beyond alerting and is pre-approved by you.

Gartner lists investigating every discovered threat, whatever its priority and with no limit on volume or time, among its optional features, so ask whether your provider does it.

Three further points matter for this kind of attack:

• Identity and SaaS. Gartner calls identity arguably the most important piece of modern infrastructure, and says SaaS coverage is now a key differentiator that buyers should add to their evaluation criteria.
• Your own response. MDR providers are generally responsible for disrupting and containing threats, but full remediation has to happen inside your organisation. Gartner is blunt that a detection is of little use without your own prepared incident response processes.
• AI. Gartner forecasts that by 2029, 90% of initial MDR findings will be handled with AI support and no human action, up from 30% today. It still maintains that MDR is a human-led service, and tells buyers to demand clarity on which parts are AI-augmented and which rely on analysts.

Speed is the reason this matters. Mandiant reports that in many of its cases the whole sequence, from first contact to data theft and extortion, happened within a single business day, with data theft starting in under an hour. A service that only forwards alerts for someone to read in the morning is working to a different clock. More broadly, CrowdStrike’s 2026 Global Threat Report puts the average eCrime breakout time, from first foothold to lateral movement, at 29 minutes in 2025, with the fastest at 27 seconds. That is a general eCrime figure, not specific to this group.

Robert Kehoe, who sees MDR tenders come in, says in a 2026 Smarttech247 webinar that buyers want AI but also want a knowledgeable human to call when something goes wrong. He adds that a good provider keeps tuning detection rules to your environment, not just at onboarding.

‍

Test it: an after-hours incident walkthrough

Gartner’s guide recommends proof-of-concept testing where possible. Smarttech247’s commentary adds that a real-world escalation is where the value shows up, or doesn’t. Ask each provider to walk through this scenario, which follows the pattern the FBI and Mandiant describe:

1. An invoice email, then a call from “IT support”. An employee is asked to grant access. Ask: how do you verify support requests through known internal channels?
2. Remote access is granted. A legitimate remote tool appears on a device. Ask: how do you tell an approved session from an unapproved one, and how fast?
3. Files leave. Large transfers go out through tools like WinSCP or Rclone, or to a personal cloud drive. Ask: what flags unusual behaviour when no malware is present?
4. The analyst acts. An analyst validates, isolates the device or disables the account, and preserves evidence. Ask: who decides, and what happens before you call us?
5. Afterwards. Ask: how quickly do we get a report, and what does it cover? Smarttech247’s identity incident response brochure sets the bar here: prove the attacker has no remaining foothold, not just close the alert.

What you can do this week

These steps come from the FBI and Mandiant, and apply whichever provider you use:

• Set and communicate a policy for how IT support will contact staff and prove who they are.
• Use phishing-resistant multi-factor authentication wherever you can.
• Block or alert on unapproved remote access tools, and restrict external drives on machines that hold sensitive data.
• Alert on mass file downloads and on WinSCP or Rclone transfers to outside addresses.
• Check the ID of anyone arriving on site to do IT work, and confirm the visit with your real IT provider.

What UK buyers should check

Ask where analysts are based, what support hours apply to your time zone, and where your data is stored and processed. Gartner’s guide advises validating compliance and residency requirements before you select a provider. Firms that hold client data should also confirm that the provider can support the incident documentation and reporting you may need to give clients.

Frequently asked questions

What is the difference between EDR, SIEM, SOC, MDR, XDR and MXDR?

Providers use these terms loosely, so ask what is included rather than relying on the label. Gartner notes that some providers repackage EDR alerting or co-managed SOC services under the MDR label.

Does 24/7 monitoring mean 24/7 response?

Not necessarily. Monitoring can mean alerts are forwarded to you. Response needs analysts who investigate and the authority to act. Gartner advises against services that only forward alerts without adding context.

Can MDR detect attacks that use no malware?

It can, if it monitors identity, cloud and remote-access activity and uses behavioural baselines. It cannot if it relies on malware signatures on endpoints. Exposed secrets in code, as in the FulcrumSec cases, are a prevention problem as much as a detection one.

How do I test a provider before committing?

Define the outputs you need first, then run a proof of concept and the after-hours walkthrough above. Gartner recommends proofs of concept and warns against relying on SLAs alone.

To see how Smarttech247 approaches this, read about our managed detection and response service.