The Silent Ransom Group (SRG), also known as Chatty Spider, Luna Moth, and UNC3753, targets law firms and other sensitive sectors in the US using social engineering and physical access methods to gain network entry. Instead of deploying ransomware encryption, SRG focuses on data exfiltration followed by extortion via data leak threats. To protect their infrastructure, SRG uses DNS fast flux, a technique that rapidly changes DNS records across a botnet of infected routers, modems, and IoT devices distributed globally. This fast flux network obscures the location of their C&C servers by rotating IP addresses and DNS name servers, complicating defensive actions. The group’s domains involved in fast flux include ep6pheij[.]com and business-data-leaks[.]com. The FBI and Resecurity have documented these tactics, highlighting SRG’s significant impact on the legal industry and other sectors handling sensitive data.

SRG’s use of DNS fast flux enables persistent and resilient C&C infrastructure, making it harder for defenders to block or take down their servers. Their attacks result in data theft and extortion, causing reputational damage, financial loss, and operational disruption to targeted organizations, especially law firms in the US. The group’s tactics have contributed to a rise in ransomware-related incidents in the legal sector, which accounted for nearly a quarter of such incidents in early 2026. The fast flux technique itself does not exploit a software vulnerability but supports the threat actor’s ability to evade detection and maintain control over compromised environments.

There is no patch or direct fix for the DNS fast flux technique as it is a threat actor operational method rather than a software vulnerability. Organizations should focus on detecting and blocking fast flux domains and IP addresses through threat intelligence feeds and DNS monitoring. Enhancing user awareness to resist social engineering and vishing attacks is critical, as SRG relies heavily on these methods for initial access. Network defenders should monitor for unusual DNS activity and implement controls to limit unauthorized remote access and physical device insertion. Collaboration with law enforcement and threat intelligence providers is recommended to track and respond to SRG activities.