Behind the Help Desk Call: Insights from the Leaked Chats of an IT

A cyber-criminal operation, associated with the brand SRG (also known as Luna Moth or Chatty Spider), targets U.S. law firms using a dual-track access model. The first track, "MAIN," utilizes bulk phishing emails and remote-access tools to impersonate IT support. The second, "TRG/SPR," is a high-value operation involving scheduled calls to executives and the physical deployment of agents to victim sites to insert storage devices. Internal records from a leaked Rocket.Chat database claim total payments of $206.95 million from 27 victims, though these figures remain unverified by external parties.
The group employs a corporate organizational structure with defined roles, revenue shares, and performance reviews. While the "MAIN" operation degraded by mid-2026 due to spam filtering, the group pivoted toward more human-centric coercion and physical access. They have experimented with AI tools like ChatGPT for operational security and explored deepfake technology for social engineering, though the latter has not been confirmed as successful. The operation relies on low-cost infrastructure, such as rented VPS and forged IDs, shifting the primary capital investment toward human personnel.

* A dataset of 5,692 chat messages from two Rocket.Chat servers spans August 27, 2025, to September 29, 2026.
* Four primary personas are identified: Henry (lead operator), Adrian (principal/ledger keeper), James (infrastructure), and Spectrum (U.S. field operations).
* The group is linked to the SRG brand, also tracked as Luna Moth, Chatty Spider, and UNC3753.
* The "MAIN" operation uses bulk emails and a 3CX phone system to obtain remote sessions.
* The "TRG/SPR" operation uses scheduled calls and physical agents with forged IDs to access sites.
* Internal ledgers claim 27 victims and total payments of $206.95 million.
* Operating costs include $1,300 per forged ID and monthly rentals for Google Drive and SSH servers.
* Tools used include AnyDesk, Zoho, Quick Assist, and SimpleX messenger.
* Henry used ChatGPT for drafting communications and operational safety queries.
* Identified infrastructure includes the domains aim6umein3kee[.]com and slplsskdj2836v2jjsx[.]com.
* The group targeted U.S. law firms, with activity peaking between 12:00 and 21:00 UTC.

The strongest version of this narrative is that of a highly professionalized "crime-as-a-service" entity that has successfully transitioned from digital phishing to physical infiltration. By treating extortion as a corporate venture—complete with KPIs, revenue shares, and season reviews—the actors maximize efficiency and scalability.
The narrative relies on a database extraction that has not been independently verified, yet it presents internal criminal ledgers as primary evidence for a $200 million haul. While the source acknowledges the lack of victim confirmation, the precision of the numbers creates a veneer of objective truth. This is a classic data-driven framing where the volume of specific figures is used to anchor the reader's perception of the group's success.
Patterns detected: none
The driving paradigm is the "Corporate Criminal" model. It assumes that the most effective way to scale illicit activity is to mirror legitimate business structures. This echoes the evolution of ransomware gangs into "affiliate" models, where the boundary between a professional services firm and a criminal enterprise disappears.
The implications for human agency are concerning: the shift toward "human agents" and forged IDs suggests that the primary vulnerability is no longer a software bug, but the inherent trust in physical presence and professional attire. The cost of defense shifts from technical patching to rigorous physical security and procedural verification.
Bridge Questions:
1. If the financial claims are fabricated for internal prestige or partner recruitment, how does that change the assessment of the group's actual threat level?
2. What organizational failures allow "agents" with forged IDs to gain physical access to high-security law firm environments?
Counterstrike Scan: An influence campaign pushing this would likely exaggerate the "physical agent" threat to sell physical security audits or specialized surveillance hardware. The actual content remains focused on the leaked data and ATT&CK mapping without a direct sales pitch, suggesting it is a genuine intelligence analysis.