Check Point Research said that around 5 October 2026 an anonymous dark-web site posted files it presents as internal papers of Silent Ransom Group, also called Luna Moth. The leak holds chats, screenshots, a call script and a résumé for a supposed fake employee. Check Point counted 42 law firms among the group's 50 most recent known victims.
Check Point said nobody knows who posted the files or how they were obtained, so it treats them as unverified. They contain no new exploit or malware. The call script tells the caller to watch a separate group chat, which implies a second operator working on the computer. The site's headline money figure does not match its own table. Check Point said the operators' identities, any payments and any use of deepfakes still lack independent support.
If the files are real, the call keeps the victim calm while others take data. So the control point is the moment someone approves a remote session. The tools involved are legitimate, so a malware alert may have nothing to catch. Who owns that approval? Can help desk staff check who is really calling? Who may approve a session after hours?