1. Executive summary
Two cybercriminal groups — Silent Ransom (aka Luna Moth) and BlackFile (now self-styled "Redact") — are actively conducting data-theft extortion campaigns that have converged on the financial and legal sectors as of July 2026. BlackFile/Redact has explicitly targeted private equity firms, hedge funds, financial rating agencies, and law firms, using high-volume vishing to steal credentials and exfiltrate data from OneDrive, SharePoint, and other SaaS applications; Google estimates the group collected over USD$10 million between February and mid-May 2026, with an average ransom of USD$750,000. Silent Ransom/Luna Moth has extracted payments of USD$10 million and USD$18 million from two law firms this year and has evolved from phishing-delivered remote access tools to in-person social engineering posing as IT support staff. Attribution for both groups is unconfirmed — neither has a MITRE ATT&CK profile. EMEA financial services firms, particularly those with privileged client data or intellectual property, face an elevated and immediate extortion risk.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | BlackFile/Redact has explicitly targeted financial entities (private equity firms, hedge funds, financial rating agencies) with credential theft and data exfiltration from SaaS platforms; successful exfiltration of confidential client data would constitute a major ICT-related incident. | Firms must ensure their incident classification and reporting workflows under DORA Art. 18/19 account for data-theft extortion scenarios where no encryption or availability impact occurs — exfiltration of confidential data alone can meet the major-incident threshold. |
| NIS2 Art. 23: incident reporting obligations | The campaign targets sectors in scope of NIS2 (healthcare, transport, financial infrastructure) with credential-based SaaS exfiltration that may not trigger traditional ransomware detection or reporting thresholds. | NIS2-regulated entities should verify that credential-theft-driven data exfiltration from SaaS platforms is explicitly covered in their incident reporting procedures and early-warning notification timelines. |
3. Technical analysis & attack chain
This item covers two distinct groups conducting data-theft extortion. Neither group has a confirmed MITRE ATT&CK profile; attribution rests on GTIG reporting as cited by the source.
Group 1: Silent Ransom / Luna Moth
Attribution: Unconfirmed. No MITRE ATT&CK profile exists for "Silent Ransom" or "Luna Moth" in the verified reference data.
Attack chain
- Initial access (historical, 2023–2025): Phishing emails targeting law firm personnel, convincing victims to install legitimate remote access software (specific product not named in source). The legitimate tool was then used as the exfiltration channel.
- Initial access (current, 2025–2026): In-person social engineering — operators physically present at target premises posing as IT support staff to gain direct system access. This represents a significant operational shift from remote-only phishing.
- Data exfiltration: Prioritises speed over completeness. GTIG reports the entire process — from initial target contact to data theft and extortion — is frequently completed within a single day.
- Extortion: Threat of public disclosure of stolen data. Law firms are assessed as highly motivated to pay quietly due to reputational and attorney-client privilege exposure.
- Observed impact: Two law firms — Goodwin Procter (USD$10 million) and WilmerHale (USD$18 million) — confirmed to have paid ransoms in 2026, as reported by The Cyber Risk Insurer.
Group 2: BlackFile / "Redact"
Attribution: Unconfirmed. No MITRE ATT&CK profile exists for "BlackFile" or "Redact" in the verified reference data.
Attack chain
- Initial access: Sophisticated high-volume voice phishing (vishing) attacks against target organisation employees to steal credentials. The source does not specify the exact vishing methodology (e.g., VoIP spoofing, call centres) beyond "high-volume."
- Data exfiltration: Stolen credentials used to access and exfiltrate data from Microsoft OneDrive and SharePoint. The group also pivots to other SaaS applications beyond the Microsoft stack (specific applications not named).
- Exfiltration profile: More comprehensive than Silent Ransom/Luna Moth — the group invests in broader data collection rather than speed-only.
- Extortion: Threat of publication of stolen data, with particular leverage against organisations holding valuable intellectual property, source code, or sensitive VIP client data.
- Observed impact: USD$10 million+ collected February–mid-May 2026 (estimated via Bitcoin transaction analysis by GTIG). Average ransom: USD$750,000. Reuters reported attempted attacks against major hedge funds and private equity firms on Wall Street in the week preceding publication.
Targeting timeline (BlackFile/Redact, per GTIG)
| Period | Targeted sectors | Notable targeting criteria |
|---|---|---|
| Apr–May 2026 | Real estate, healthcare, insurance | — |
| Jun 2026 | Technology, transportation, hospitality | Valuable IP, source code, sensitive VIP client data |
| Jul 2026 | Financial and legal sectors | Private equity firms, law firms, financial rating agencies |
Confidence caveat: All technical detail above is single-sourced — it derives from the Risky Business newsletter citing GTIG and Reuters. The ransom payment figures for Silent Ransom/Luna Moth originate from The Cyber Risk Insurer, also relayed via the same newsletter. Verify before enforcement.
4. Mitigation & containment
P1 — Within 24 hours
- Vishing countermeasures: Alert helpdesk and reception staff that attackers are conducting high-volume voice phishing calls impersonating IT support. Establish a callback verification protocol: any credential reset, MFA re-enrolment, or SaaS access request received by phone must be verified by calling back the requester through a known internal number. This directly addresses BlackFile/Redact's primary initial access vector.
- SaaS access review: Review and audit all active sessions and recent authentication events across Microsoft 365 (OneDrive, SharePoint) and other SaaS platforms for anomalous access patterns — unusual IP geographies, access at atypical hours, bulk download activity, or access from devices not previously associated with the user.
- In-person social engineering awareness: Silent Ransom/Luna Moth has used in-person IT support impersonation. Notify physical security and facilities teams; verify that all on-site IT support requests are validated through internal ticketing and known staff verification.
P2 — Within 72 hours
- Conditional access hardening: Enforce MFA on all SaaS authentication (if not already in place). Implement conditional access policies restricting SaaS logins to managed/corporate devices and expected geographies. Block legacy authentication protocols.
- SaaS data exfiltration controls: Configure Microsoft 365 DLP policies to alert on bulk file downloads from OneDrive/SharePoint. Review audit logs for mass file access or download events in the preceding 30–60 days, consistent with BlackFile/Redact's activity window.
- Credential rotation: Force password resets for any accounts showing anomalous SaaS session activity identified in P1.
P3 — Within 7 days
- Threat-led red team exercise: Engage internal or external red teams to test vishing resilience — specifically the helpdesk callback verification workflow and susceptibility to credential-theft-by-phone across business-facing teams.
- Incident response plan update: Ensure IR playbooks include a data-theft extortion scenario distinct from ransomware encryption scenarios. The response workflow differs: there is no decryption negotiation, no backup restoration path, and the leverage is reputational rather than operational. Escalation paths to legal, communications, and executive stakeholders must be defined in advance.
- SaaS third-party risk: Review DORA Art. 28 obligations regarding ICT third-party providers — ensure contractual provisions with SaaS providers (Microsoft 365 and others) cover incident notification timelines and audit log retention sufficient for forensic investigation of exfiltration events.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, email addresses) are present in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| High-volume inbound voice calls to staff requesting credential resets or MFA re-enrolment, impersonating IT support | Telephony logs, helpdesk ticketing system, staff reports | High — corroborated by GTIG reporting on BlackFile/Redact methodology |
| Bulk file downloads or unusual access patterns from OneDrive/SharePoint | Microsoft 365 audit logs (Unified Audit Log), Microsoft Defender for Cloud Apps | High — explicitly described as BlackFile/Redact exfiltration method |
| Credential-based access to SaaS applications from unfamiliar devices or geographies | SaaS provider authentication logs, conditional access logs, SIEM | Medium — inferred from credential-theft-to-SaaS-access chain |
| In-person individuals claiming to be IT support staff, requesting physical access to systems or workstations | Physical security access logs, reception/front-desk staff reports | Medium — described for Silent Ransom/Luna Moth; single-sourced via GTIG |
| Rapid exfiltration timeline (initial contact to data theft within ~24 hours) | Correlation of authentication events with bulk data access in SIEM | Medium — GTIG assessment of Silent Ransom/Luna Moth operational tempo |
6. Detection
Insufficient indicators to author detection rules. The source material describes behavioural patterns (vishing, SaaS credential abuse, in-person social engineering) but does not contain threat artefacts such as file hashes, distinctive strings, command-line flags, mutex names, scheduled task names, or specific tool fingerprints that would support a valid YARA or Sigma rule. Authoring rules from the described behaviours alone would detect normal administrative activity with no discriminative value.
7. Sources
- Risky Business News / Tom Uren, "Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!", https://news.risky.biz/srsly-risky-biz-data-theft-extortion-is-booming-hooray/, 2026-08-13
- The Cyber Risk Insurer (ransom payment figures for Goodwin Procter and WilmerHale, as cited by the primary source)
- Google Threat Intelligence Group / GTIG (BlackFile/Redact and Silent Ransom/Luna Moth operational detail, Bitcoin transaction estimates, targeting timeline, as cited by the primary source)
- Reuters (attempted Wall Street attacks linked to BlackFile, as cited by the primary source)
8. Adverse Trace position
This is a high-severity strategic threat for EMEA financial services clients. The convergence of two well-resourced extortion groups on the financial and legal sectors — confirmed by GTIG targeting data and Reuters reporting on Wall Street attacks — represents a direct and current risk to private equity firms, hedge funds, financial rating agencies, and law firms in scope. The operational shift from encryption-based ransomware to data-theft extortion is significant: it bypasses backup-based recovery mitigations entirely and exploits reputational leverage that is particularly acute for client-confidential businesses. Attribution for both Silent Ransom/Luna Moth and BlackFile/Redact is unconfirmed (no MITRE profiles exist); all technical and financial details are single-sourced through the Risky Business newsletter citing GTIG, Reuters, and The Cyber Risk Insurer — verify before enforcement. We will monitor for corroborating reporting from GTIG primary publications and additional victim disclosures, and will issue updated IOCs and detection rules if atomic indicators emerge. Clients should immediately implement vishing callback verification protocols and review SaaS authentication logs for indicators of prior compromise.
Published via PulseTrace — Adverse Trace threat intelligence.