Welcome to The Optery Dispatch — a newsletter delivering the latest insights on threat intelligence and proactive cybersecurity strategy. In Issue #18, published October 21, 2026, we cover:
- Silent Ransom Group’s leaked chats reveal data broker use in targeting law firms
- Microsoft Report: Identity compromise remains the leading threat to organizations
- Comcast Business Report: Phishing leads initial access as AI accelerates familiar attacks
Leaked Silent Ransom Group chats show data brokers used in targeting
GuidePoint researchers found the extortion group using ZoomInfo and RocketReach for reconnaissance while targeting law firms through IT impersonation, phishing, vishing, and even in-person attacks.
Newly leaked internal chats attributed to Silent Ransom Group (SRG) show the threat actor using commercial data sources including ZoomInfo and RocketReach as part of its reconnaissance against target organizations. GuidePoint Security’s Research and Intelligence Team analyzed 5,692 messages spanning August 2025 through September 2026 and assesses with moderate-to-high confidence that the participants operated under or alongside SRG.
Also known as Luna Moth, Chatty Spider, and UNC3753, SRG has been active since at least 2022 and has consistently targeted U.S. law firms since 2023, according to the FBI. Unlike conventional ransomware groups, SRG typically does not encrypt systems. It gains access, steals sensitive data, and extorts victims by threatening to publish or sell it.
The leaked chats provide a rare look at the reconnaissance behind those attacks. GuidePoint says the group’s commercial sources included ZoomInfo and RocketReach profiles, supplemented by LinkedIn scraping and law-firm websites. Operators assembled detailed information about victims, including revenue, security products, and endpoint counts. The group also compiled 20 per-firm rosters of leaders, job titles, and direct-dial numbers to deliver extortion demands directly to decision-makers. Thirteen included cybersecurity, privacy, or breach-response leaders.
For its highest-value targets, SRG used a highly personalized attack model. A target package documented by GuidePoint included a named partner, two phone numbers, an office address, and a script impersonating the firm’s own IT department. The chats describe arranging a call with a senior partner and sending a U.S.-based accomplice to the office posing as an IT worker. GuidePoint found no CVE mentioned anywhere in the 5,692 messages and says the group did not deploy malware in these operations, instead relying on social engineering, legitimate remote-access software, and physical access. One victim reportedly told the group that an intruder had entered its New York office and copied files to a flash drive.
Silent Ransom Group is not the only threat actor recently documented using data brokers this way. In July, Okta revealed that a vishing operation associated with CORDIAL SPIDER / O-UNC-045 was using a platform called Work Panel that integrated RocketReach directly into its reconnaissance workflow. Attackers could enter a target company and retrieve employee job titles, corporate email addresses, direct phone numbers, and LinkedIn profiles, then select employees to contact in vishing attacks.
These two 2026 cases extend a pattern we have previously documented of threat actors using data brokers for reconnaissance and targeting against organizations. As we noted in a 2025 article, leaked Conti and Black Basta communications showed operators using ZoomInfo and RocketReach; Okta concluded the 0ktapus/Scatter Swine attackers likely obtained employee phone numbers from commercial data aggregation services; and a joint CISA/FBI/CNMF advisory says Scattered Spider uses business-to-business sites and commercial intelligence tools to identify individuals within target organizations and enrich social engineering campaigns. A 2020 FBI/CISA vishing advisory also described attackers building employee dossiers using recruiter and marketing tools and public background-check services.
Removing exposed employee information from data brokers is a necessary mitigation to help prevent these kinds of targeted attacks against organizations and their people.
Read more: Silent Ransom Group Leaked Chats: Key Findings by GRIT; Bird Watching: Characterizing Falcon-branded Extortion Operations
Microsoft: Identity compromise remains the leading threat to organizations
Social engineering and stolen credentials dominate initial access methods.
Microsoft’s 2026 Digital Defense Report says identity compromise remains the leading threat to organizations. Microsoft Defender Experts found that more than half of observed initial-access activity involved either valid accounts or users being tricked into taking an action that executes malicious code, such as following fake browser-update prompts or other social engineering lures. Phishing and malicious copy-and-paste attacks accounted for another quarter of observed activity.
From July 2025 through June 2026, malicious email payloads detected by Microsoft Defender for Office 365 were almost exclusively associated with credential phishing rather than malware delivery. Each month, 89% to 96% of malicious attachments directed users to phishing pages or convincing sign-in experiences designed to steal credentials. Once attackers gain valid access, the damage can compound: 52.2% of valid-account intrusions involved additional credential theft.
Microsoft says threat actors are already using agentic AI for reconnaissance, data triage, phishing-lure development, and multi-source research that can be synthesized to inform targeting. Generative AI is also being used to create context-aware lures that incorporate specific details about a person or company, while AI-assisted analysis can be used to create intelligence dossiers on people.
That is contributing to what Microsoft calls a shift from brand mimicry to “context mimicry.” Nearly 85% of reported phishing emails Microsoft analyzed from April through June 2026 showed signs of impersonation, with attackers mimicking relationships, departments, vendors, workflows, and organizational routines.
Microsoft’s findings reinforce the need to remove exposed employee information that attackers can use for reconnaissance and targeting.
Read the full report: 2026 Microsoft Digital Defense Report – Decoding emergence
Comcast Business Report: Phishing Leads Initial Access as AI Accelerates Familiar Attacks
Attackers are scaling personalized phishing and exploiting trusted accounts and support workflows to gain access.
Phishing, help desk impersonation, and stolen credentials remain central to how attackers gain access. The 2026 Comcast Business Cybersecurity Threat Report shows how AI and automation are helping them execute these familiar techniques faster and at greater scale.
Across 79.3 billion cybersecurity events observed over a year, Comcast detected 25.4 billion phishing events, making phishing its most frequently observed initial-access technique. Link-based phishing accounted for 11.2 billion events, the largest tracked sub-technique, encompassing both mass campaigns and messages targeting specific individuals.
The report describes AI helping attackers personalize lures at volume and mirror internal language. Across Comcast’s observations and external research cited in the report, attackers used several familiar techniques:
- Help desk impersonation: Comcast repeatedly observed attackers flooding employees’ inboxes, then posing as IT support over Microsoft Teams and guiding them into granting remote access.
- Phishing from compromised accounts: Attackers sent phishing messages from compromised internal and partner accounts, exploiting recipients’ trust in the sender.
- Vishing: Attackers called help desks and persuaded privileged users to authorize malicious apps to access company data.
- Device-code phishing: Attackers tricked users into authorizing access through legitimate authentication workflows. Comcast documented an example in which a user entered an attacker-supplied code on a genuine Microsoft login page, inadvertently granting the attacker an access token despite MFA.
Meanwhile, AI and automation are compressing the window between vulnerability discovery and exploitation. Comcast emphasizes phishing-resistant MFA, continuous identity verification, behavioral monitoring, and rapid containment and recovery.
For security teams, reducing exposed employee personal information limits the intelligence available for targeted social engineering. Removing that information from data broker and people-search sites complements the controls that protect accounts and detect compromise.
Read the full report. 2026 Comcast Business Cybersecurity Threat Report | Comcast Business
Thanks for reading! Want us to write about something specific? Submit a topic or idea.
If you’re looking to reduce your organization’s exposed PII and dramatically lower the volume of phishing, voice and messaging scams, credential theft attempts, and other PII-based threats your team has to defend against, Optery can help. We find and remove dozens more exposed profiles per person on average than competing services, and we prove it with before-and-after screenshots.
Get started here: Optery for Business
Subscribe to receive future editions of The Optery Dispatch