A set of leaked internal chats from an extortion crew called Silent Ransom Group is giving defenders a rare look at how an IT impersonation help desk scam is organized behind the scenes. According to a breakdown from GuidePoint Security's research team, GRIT, the chats reveal IT-impersonation tactics, the use of in-person agents, and a payment ledger totaling $206.95M.
The published summary is brief, so this post sticks to what it states and focuses on what readers can do with it.
What the Silent Ransom Group leak reveals
The leak is notable because it comes from the attackers themselves. Instead of reconstructing a campaign from victim reports, researchers had access to the group's own conversations. GRIT's analysis, as summarized, highlights three things:
- IT-impersonation tactics: the group builds its approach around posing as technical support.
- In-person agents: the operation is not purely remote.
- A $206.95M payment ledger: a record of payments that points to the scale of the operation.
We have not independently verified the chats or the ledger, and the summary does not break down how the figure was calculated. It is best read as a signal of how profitable this style of attack appears to be, not as a precise audited total.
How the help desk impersonation works
The core idea behind any help desk impersonation is simple: attackers pose as the people employees already trust to fix problems. Most of us are conditioned to cooperate with IT. If someone says they are from support and need a moment of your time, the default reaction is to help.
That trust is the weakness being exploited. Rather than hunting for a software flaw, the attacker aims for a human decision: approving a request, sharing a code, or letting someone in. Because the attack relies on persuasion, it can work even when security tools are well configured.
The same pattern shows up in other recent campaigns. A hacking group was reported to be abusing Microsoft Teams to get into corporate networks, as covered in our piece on fake IT support on Microsoft Teams fueling a ransomware spree. Another operation that surfaced in early 2026 skipped encryption entirely, as we explained in BlackFile vishing extortion and data theft without malware. The channel changes (chat, phone, email), but the pretext of "we are IT, and we need you to do something" stays the same.
Why in-person agents and a $206.95M ledger matter
Two details from the leak stand out.
First, the in-person agents. Many security awareness lessons assume impersonation happens through a screen or a phone line. An operation that also uses people on the ground suggests that a caller's claim, a name badge, or a confident manner should not be treated as proof of identity. Verification needs to apply to every channel, not just email and phone.
Second, the ledger. A $206.95M payment record, even taken with caution, suggests extortion built on social engineering can be organized and repeatable, not opportunistic. That matters for smaller organizations in particular. It is easy to assume criminals only chase large enterprises, but a process-driven crew has every incentive to run the same playbook against anyone who answers the call.
This also echoes how long these methods have lasted. Our coverage of Scattered Spider claiming a new victim with an old social trick made a similar point: tried-and-true persuasion keeps working because it targets people, not code.
What this means for you
If you are an individual, the lesson is that a legitimate-sounding "IT" contact you did not ask for deserves suspicion, no matter how professional it sounds. If you run a small business, you probably do not have a dedicated security team, which makes a clear, simple process more valuable than any tool.
The practical goal is to separate who is contacting you from who you trust. A caller can claim to be anyone. A phone number you look up yourself, or a ticketing system you already use, cannot be faked by a stranger's script.
How to verify unexpected IT support contacts
These steps apply whether the contact arrives by phone, chat, email, or in person:
- Pause when the contact is unsolicited. If you did not open a ticket or request help, treat the contact as unverified by default.
- Use a call-back habit. Hang up or end the chat, then reach IT through a number or channel you already know from official company materials, not one the contact gave you.
- Never share codes or approve prompts on request. Multi-factor codes and login approvals are for your own sign-ins, not for a helper to use.
- Be wary of remote access requests. Do not install tools or grant screen control based on an unexpected contact.
- Verify visitors. If someone shows up claiming to be IT, confirm with your real IT provider or manager before giving access to a device or room.
- Agree on a process in advance. Small teams should decide how legitimate IT requests will be made, so staff know what a real one looks like.
- Report it. Tell your IT contact or manager about suspicious attempts, even if you did not fall for them. Others may be targeted next.
The takeaway
The leaked Silent Ransom Group chats underline that an IT impersonation help desk scam is a business process for the people running it, not a one-off trick. The defense is also a process: slow down, hang up, and call back through a channel you trust. Make that call-back verification a habit for every unsolicited IT contact, and share it with your team or family. For more examples of the same tactic, read our coverage of fake IT support on Microsoft Teams and vishing-based extortion.
