Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew
TL;DR – On October 06, 2026, GuidePoint Security received a copy of internal message chats that appeared to be from a group known as Silent Ransomware Group. During the period covered by the chat export (August 27, 2025, to September 29, 2026), we observed the following relevant findings in the chats:
- The chats appear to be from Silent Ransom Group (SRG) and show an attempt at a deliberate rebrand (to Sleepless Threat) to evade law enforcement. The tradecraft analysis matches the FBI’s May 2025 notice on SRG. We assess with moderate-to-high confidence that the people in this chat operate under or alongside, the SRG name.
- No CVE appears in 5,692 messages and no malware was deployed by the group in their operations. Instead, the crew gained access by telephoning employees while posing as the firm’s own IT department and by sending a person (AKA agent) to the victim’s office to plug in a storage device.
- The target victims are large law firms. In 20 per-firm rosters posted between July 30 and September 4, 2026, the operators list managing partners, COOs, CIOs, general counsel and, in 13 of the rosters, the firm’s own cyber or privacy partners.1
- The group’s internal ledger claims $206.95 million in payments from 27 organizations between April 3 and September 24, 2026. These are the actors’ own figures and have not been verified on-chain, so figures should be taken with a grain of salt.
- Victims confirm a physical vector for exploitation. One victim’s negotiation letter, pasted into the chat, states that a person entered its New York office and copied files to a flash drive.2
Introduction
GuidePoint’s Research and Intelligence Team (GRIT) reviewed a JSON export of 5,692 chat messages from two self-hosted Rocket.Chat servers. The messages span August 27, 2025, to September 29, 2026, across 36 rooms and eight usernames, including seven people and the platform’s built-in bot. GRIT downloaded an export of the messages after the group’s chat room was published online.
We assess the export as a genuine database extraction for the following reasons:
- It retains eight automated Rocket.Chat update notices from the platform bot.
- 5,688 of the 5,692 messages contain fractional timestamps that have millisecond-precision values consistent with the platform’s database format.3
- 590 messages contain internal permalinks resolving to the same two hostnames the export reports.
- The onboarding noise survives: each new participant types their own name into a general room as a test.4
- Direct-message room IDs decode consistently to the same pair of users across four rooms.
Note on limitations: Quotations from Russian-language messages are our AI-assisted translations; English quotations are verbatim, including typos. The export has no attachments, edit history or deleted messages. Several people that the operators discuss, for example, the agent-contact coordinator and a team lead, never appear as participants, so the export is a subset of the group’s communications. Usernames are personas and nothing here concretely ties them to any real identities. All timestamps are UTC; pasted Telegram excerpts carry their own clocks and confirm this. Time offsets are about four hours behind for one operator and three hours ahead for another.
At the time of writing, GRIT has not traced the Bitcoin addresses in the chats. This post covers what the chat content shows. It does not cover blockchain analysis.
Who Is in the Chat
Four personas carry the volume of chat messages:
|
Persona
|
Messages
|
Role shown in the chats
|
|---|---|---|
|
Henry |
3,382 |
Appears to be the lead operator for the two business lines; makes the extortion and recon calls; recruits |
|
Adrian |
1,668 |
Principal; keeps the ledger; sets pay and revenue shares; announces each payment |
|
James |
174 |
Infrastructure ("our IT"); later founds the "Sleepless" spin-off |
|
Spectrum |
337 |
Writes only in English; handles U.S. field operations; silent after May 7, 2026 |
Three more personas appear briefly: Dean (23 messages) and two operators, Mike and Monty, who exist only on the second server from September 2026.
Adrian assigns compensation directly: 10% to Henry on one business line and 4% raised to 5% on the other.5 Operators receive crypto bonuses of $500 to $3,0006 and management-tier bonuses of $2,000.7 The tone is corporate: season reviews, record announcements and term revisions “after this season”.8
The core operators write mostly in Russian and keep a separate English-language channel for the two members who do not read it. Activity follows the U.S. business day. About 74% of messages fall between 12:00 and 21:00 UTC (08:00 to 17:00 Eastern) and the largest single day of the corpus, March 13, 2026, produced 312 messages.
Connection to Silent Ransom Group
Three specific messages tie the crew to the brand tracked publicly as SRG:
- On May 1, 2026, Adrian posts a link to a databreaches.net article whose URL reads “silent-ransom-group-leaked-another-big-law-firm-orrick-herrington-sutcliffe”. He says the group contacted “him” (presumably the article’s author, which the chat does not state) and “sent all the details”, that the post told readers to “look what will happen, better pay” and that leaking two firms “greatly affected our reputation”.9
- On September 2, 2026, James proposes to “blur our resemblance to SRG” by buying unrelated network access and writing to victims as “Sleepless Threat”.10
- The same evening Adrian puts the “steal oldie” (kidnapping) plan on hold because they “may be recognized as terrorists and [payment] to SRG forbidden”.11 The sentence’s grammar is ambiguous, but it refers to SRG as the name victims pay.
The FBI’s Private Industry Notification of May 23, 2025, describes SRG (also tracked as Luna Moth, Chatty Spider and UNC3753) as targeting U.S. law firms with IT-themed phone calls and then sending a person in-person to insert a storage device. It also describes callback-phishing emails and the abuse of remote-access tools used by the group. This sequence matches what the chats document.
We assess with moderate-to-high confidence that the people in this chat operate under or alongside, the SRG name. We have not independently verified the linked article.
Two Ways In
The operators run two access models in parallel and budget them separately.
|
|
MAIN (their term)
|
TRG / SPR ("target" / "super target")
|
|---|---|---|
|
Method |
Bulk email, then victim phones the crew |
Scheduled call to a named executive, then a person visits the site |
|
Scale |
High volume, lower value |
Low volume, highest value |
|
Needs |
Email contractor, PDF lures, phone system |
U.S.-based human "agents," forged IDs |
|
Status |
Degraded by June 2026 |
Core through the end of the corpus |
MAIN: The Callback Funnel
On January 16, 2026, Adrian hands Henry the whole MAIN operation with a written job description that doubles as a parts list:12
- Buying phone numbers and servers for a 3CX phone system (rented VPS in the Netherlands)13
- Managing “the spammer,” an outsourced contractor and choosing subject lines and writing the texts
- “The PDFs,” produced by the group’s IT staff, which Henry checks for errors
- A “success page” website (its function is never described in the chats)
The chats do not narrate what a victim experiences. This sequence is therefore inferred: an email with a PDF containing a support number, a victim who phones it and an operator on the 3CX system who impersonates IT support and obtains a remote session. This matches the14 download.15
MAIN stalled in mid-2026. Henry writes that it “is stalling due to spam related issues”16 and on June 27 that “MAIN no longer works”.17 The group’s response was to add new human-centered methods, not to repair the email channel.
TRG: The Call That Books the Visit
For the targeted victim model, the call is appointment-setting. One operator describes the plan to arrange a “deal” with a senior partner for a specific time, sends the agent and has the agent present as an IT assistant. A target package posted on March 12, 2026, shows the format of this plan: the agent’s Telegram handle, a date, the named partner, two phone numbers, an office address, a separately labeled “UAC PASS” code and a script:
“Hello. This is [Firm] IT Department, connecting you to the IT specialist, [Name].”19
Three details matter for defenders:
- The caller claims to be the firm’s own IT department. That defeats awareness training that focuses on outside vendors.
- A named “specialist” is handed the call. A personal name is harder to disprove inside a large firm than an anonymous help desk.
- A person arrives. The call supplies authority for what the agent then does at the keyboard.
Victim Data Retention Concerns
On February 20, 2026, Adrian pastes a victim’s message: “We know it was a physical intrusion from an individual who entered our New York office and transferred files to a flash drive.” The same letter cites the U.S. Department of Justice’s LockBit case to argue that deletion promises cannot be trusted and lists four settlement conditions: deletion of all digital and physical copies, confirmation of the file list, no re-extortion and confidentiality.27 Henry’s private reaction confirms the victim was right to worry about physical copies.28Who They Call
Between July 30 and September 4, 2026, Adrian posts 20 rosters, one per firm.29 Each roster arrives with a package in a fixed format:- An attacker email address (“НАШ EMAIL,” meaning “OUR EMAIL”)
- A disposable Google Voice number, with its Gmail login, recovery address, backup codes and a U.S. state label
- The roster itself: the firm’s leaders, with titles and direct-dial numbers copied from public sources
Why Does This Threat Actor Target Large Firms?
Henry argues, “the bigger the firm, the more points of entry and dumb oldies”.36 The recon sources are commercial: ZoomInfo and RocketReach profiles,37 LinkedIn contact scraping38 and firm websites.39 The group records each victim’s endpoint count and installed security product alongside revenue, for example “hosts 12k+,” “Def + Sophos,” and “AV: symantec”.40The Agents
The group relies on a managed network of U.S.-resident helpers it calls agents.- Size: On November 24, 2025, one operator estimates “around 10 – 14” agents and another says “more than 15 in total” including those still being vetted.41
- Recruitment: Agents are hired through ordinary-looking job adverts. Henry reports paying $200 for one,42 recruiting via a “driver” vacancy43 and drafting adverts for “promoter” and “security” roles.44 Some adverts are written with ChatGPT (see AI Use section).
- Documents: Agents carry forged U.S. identification. Buying IDs costs “about $1,300 each” with multi-week delivery, so the crew weighs a $5,000 in-house capability plus $100 to $600 in equipment.45 An upkeep request for the network in December 2025 was $8,500, excluding documents.46
- Control of agents: The coordinator’s top duty is staying in contact, because “the agents may panic if we are out of contact for more than 24 hours”.47 Agent channels follow a NAME_NNNN_STATE pattern and one was renamed with the suffix _CAUGHT on April 7, 2026.48 Later Adrian refers to “the FBI, after catching [the agent]”.49
- Surveillance of their own: In May 2026 Adrian directs a search for private investigators in New York to watch agents and confirm tasks, paid in Bitcoin or Zelle.50
Money
The Ledger
Adrian keeps a running plain-text ledger in the private channel, one line per victim and stage, in the form <domain>_<STAGE> followed by an amount:|
Stage
|
Presumed Meaning
|
Count
|
|---|---|---|
|
|
Initial extortion notice sent
|
4 |
Loading |
Exfiltration in progress |
4 |
Chat |
Victim engaged |
23 |
Offer |
The victim's current offer
|
67 |
Contract |
Terms agreed |
14 |
Gold |
Payment received |
28 |
GOLD presumably means payment based on our analysis. Henry reacts to this stage with “finally gold” and “congratulations on another payout,” Adrian reports “already two golds,” and each announcement is followed by a request for Henry’s Bitcoin address to pay his share.53 One entry notes the BTC rate rose between agreement and receipt, which confirms amounts are USD settled in Bitcoin.54
The ledger covers 50 organizations from February 6 to September 24, 2026. Twenty-seven have a GOLD entry.
|
GOLD size band
|
Organizations
|
Total claimed
|
|---|---|---|
|
$10 million or more |
10 |
$166.0 million |
|
$1 million to under $10 million |
8 |
$36.9 million
|
|
Under $1 million |
9 |
$4.05 million |
|
All |
27 |
$206.95 million |
By month: April $13.55 million, May $78.9 million, June $25.5 million, July none, August $21 million, September $68 million. The median GOLD entry is $6.0 million. The largest single entry, announced September 21, is $30 million, which Adrian calls a “record”.55
These are the actors’ own internal records; written to a business partner whose share depends on them; no victim has confirmed a payment. Three internal checks raise confidence.
- Each GOLD is immediately followed by a Bitcoin payout.
- On May 15 and May 18, 2026, Adrian states a season outlook of about 20 million in open offers plus another 83 million to convert, “about 130 million” in total;56 the ledger’s GOLD total at that date is $44.95 million and 44.95 plus 83 equals 127.95 million, within about 2% of his statement.
- On May 25 Henry reacts to a four-line payout post with “37 million, wow”;57 that post sums to exactly $37 million.58 This figure is also a floor: payments announced as a bare “gold” or in a different format sits outside the labeled entries.59 We report the number as “internal records claim” and do not state that the group received it.
How They Negotiate
The ledger records 16 victims with more than one offer. Fifteen of them ended higher than they started. For 22 victims with both an offer and a payment, the median multiple from first recorded offer to payment is 5.5, over a median of 10 days. At the extremes, one victim’s recorded offers rose from $100,000 to a $6 million payment in 23 days and another moved from $500,000 to $20 million in 22 days. Adrian reads an early low offer as an insult: “the first offer is short a zero”.60 In September, Henry expects offers to “grow a couple more times for sure”.61
Pressure from the Threat Actor:
The September spin-off’s first email gives a template for how this group pressures its victims:62
- Proof of access up front: a list and samples of what was taken
- A “settle quick and cheap” frame
- “Nobody except us is able to help you fix this problem, certainly not the law enforcement, there will be serious legal issues as well as regulatory fines if you contact them”
- A reputation threat tied to client confidentiality
- A 48-hour deadline, with the threat to “attack you once more and take more data”
Deadlines follow the victim’s calendar. On Friday, September 4, ahead of the U.S. Labor Day holiday, the crew told two victims they had “until Tuesday” and they noted that “Monday is a holiday for them”.63 Victims were moved from email to the SimpleX messenger. Proof of possession was handled as a file-selection challenge: the victim names files and the crew returns them with details such as drive letters and share paths.64
Victims do push back effectively. A September victim asked how it could take the offer seriously when the crew “don’t have a website, no established reputation and haven’t even provided the files you’re referring to”.65 The two initial demands were $250,000 and $450,000,66 far below the older operation’s figures.
Cost Base
The documented operating costs are small: a $200 advert, $1,300 per forged ID, an $8,500 upkeep request, 100 GB Google Drive accounts and 600 GB SSH staging servers rented by the month.67 The main capital input is people.
AI Use
Six messages contain utm_source=chatgpt.com, the tracking parameter ChatGPT adds to citation links, so the output was pasted directly from the tool.68 Another two have the same formatting.69 All eight come from Henry. They show four uses, none requiring a jailbreak of the model:
- Ransom pricing: On February 6, 2026, he pasted a table of breach settlements and fines paid by law firms ($8 million, $1.4 million, $150,000, about $200,000, about $450,000).70 A ledger entry for one of those firms had been created 19 minutes earlier.71
- Pretext research: An answer on who changes HVAC filters in a named Manhattan tower, listing the facilities vendors.72
- Recruitment copy: A polished advert for “promoters” in Miami, Orlando and New York clubs.73
- Target development: On September 23, 2026, a four-turn session on U.S. military installations and defense manufacturers in the northeast, finishing with a table that separates actual drone makers from component suppliers.74
The group also planned a deepfake video call from a lookalike IT account. Adrian writes that “it’s a small thing” once specialists are found and names a lookalike domain for a major firm.75 By May 11, the plan had stalled because an attempt to dial into a target’s Teams or Meet environment failed.76 We see no completed deepfake operation in these chats. The operators also use ChatGPT for operational safety, for example asking it, in James’s words, “what ransom group can`t do to not biin blocked” on a social platform.77
Beyond the Network
The crew’s planning moved from remote deception to coercion in 2026. We summarize the documented planning without operational detail; the chats record plans, not completed acts, apart from the single agent arrest above.
- Sexual coercion: Channels created in March 2026 plan to recruit women to approach elderly partners and record compromising video to compel access.78
- Kidnapping: A written plan of April 4, 2026, proposes abducting an employee and forcing remote access to the work computer.79 A draft job advert on May 20 offers $50,000 per person for a four-person “pick up a person” task.80
- Armed enforcement: A channel founded March 21, 2026, asks “do we need real Glocks?” for an enforcement team.81
- Military recruitment: On May 20, 2026, Adrian proposes recruiting U.S. service members, with the stated aim of obtaining information about “movements of submarine-based nuclear forces.” Reconnaissance of addresses was completed.82 The chats show no link to any state actor and we draw none.
We report on these activities because security teams should model them. They are not the main risk for most readers.
What We Did Not See
- No vulnerability exploitation, no encryptor and no deployed malware. A USB stealer was proposed and rejected on September 28,83 and raised again the next day.84
- No use of WinSCP or Rclone, the exfiltration tools named in the FBI notice. Data staging in the chats uses Google Drive accounts and SSH servers.85
- No voice cloning.
- No verification of any payments. Every dollar figure here comes from the threat actors.
- No identity evidence for any persona.
What Defenders Should Do
The controls that matter most are procedural and physical. Patching and endpoint exploit prevention provide almost no coverage against this activity but are effective at reducing the attack surface potential of an organization.
Security and IT
- Out-of-band verification for every “IT” request. No one should install software, read out a session code or approve an MFA prompt for a caller until they confirm the request through a ticket or a callback to a number from the internal directory. One way to help mitigate this activity is to publish a short standard: “IT will never cold-call you and ask for this.”
- Control remote-access tools and allow-list approved tools. Alert on the first execution of AnyDesk, Zoho Assist, Syncro, Atera, Splashtop or Quick Assist on partner, executive and assistant endpoints and block execution from removable media. The FBI notice names the first five; AnyDesk and Zoho appear in the chats;86 Quick Assist is a possible reading of one case tag.87
- Restrict removable media on high-value endpoints. The confirmed intrusion used a flash drive.88
- Watch for lookalike domains. The chats show IT-themed lookalikes of specific firms being created: a mailbox on it-<firm>.com issued with credentials,89 a <firm>-law.com lookalike requested for a named partner90 and <firm>-it.com floated as a Teams-call domain.91 Monitor newly registered domains containing your name plus it, support or helpdesk.
- Egress control. Alert on consumer cloud storage uploads from managed endpoints and on WinSCP or Rclone connections to external IP addresses (per the FBI).
- Harden external access. The spin-off lists VPN and RDP endpoints with credentials and notes which security product protects each target.92 Enforce MFA on all external remote access.
Facilities, Security and Reception
- Treat a visitor claiming to be IT as a threat until verified. The crew’s own plan is a person who arrives as the IT specialist the caller promised.93
- Escort policy for deliveries, contractors, cleaners & HVAC. The crew weighs bribing cleaners and valets, cloning access cards and sending a fake food delivery past reception.94 Their working assumption is that security will not escort a delivery worker.95 Test it.
- Reception scripts. Reception staff should not transfer callers to employee numbers on request. In one call the receptionist first transferred the call to staff numbers and then stopped.96
- Multi-tenant buildings. One planned entry would reach several firms in the same tower.97
Executives, Assistants and Communications
- Brief leadership and their assistants. Expect voicemails and calls from an unknown group claiming to hold the firm’s data. Assistants repeatedly take the message and promise to forward it.98 Define in advance who receives such a message and how it reaches the incident lead.
- Limit published direct dials and assistant contact details where practical. The call packages are built from public sources.99
- Give client-meeting rooms a media policy. A prospective client who asks a partner to run software from a USB drive is a documented technique.100
- Verify remote hires. The crew planned to place fabricated candidates in U.S. firms as remote employees, with forged diplomas, citing North Korean IT workers as the model.101
- Report unusual surveillance or approaches by strangers to a partner or family member. The crew’s planning included following targets and their children.102
Incident Response and Legal
- Do not assume deletion. The crew states it holds no copy of the data it offers to delete.103
- Expect escalation. Victim offers moved up in 15 of 16 multi-offer cases, with a median multiple of 5.5 (Money section). A low early offer is read as a signal to push.
- Treat the “don’t call the police” argument as a pressure tactic and consult counsel and law enforcement.104
- Preserve and report. Keep voicemails, caller IDs, emails and any remote-session logs, then report to the FBI (the FBI notice requests this).
- Review insurer and counsel contact lists. The crew’s recon explicitly targets the people who run breach response.
HR and Recruiting
- Be aware of adverts that look like ordinary driver, promoter or personal-security jobs. Platform trust-and-safety and law-enforcement contacts are the right escalation if you see them.105
MITRE ATT&CK Mapping
Mapped to ATT&CK Enterprise v19.1 (social engineering sits under T1684 in this version; the former T1656 Impersonation is now T1684.001). “Observed” means the chats show it in use; “planned” means the chats discuss it.
|
Tactic
|
Technique
|
Status
|
|---|---|---|
|
Reconnaissance
|
T1589.002, T1589.003 Gather Victim Identity Information (email addresses, names)
|
Observed106
|
|
Reconnaissance
|
T1591.004 Identify Roles
|
Observed107
|
|
Reconnaissance
|
T1593.001 Social Media (LinkedIn scraping)
|
Observed108
|
|
Resource Development
|
T1583.001 Domains (lookalike IT domains)
|
Observed (mailbox issued on one lookalike) 109 110
|
|
Resource Development
|
T1585.003 Cloud Accounts (Google Voice / Gmail per firm)
|
Observed111
|
|
Resource Development
|
T1650 Acquire Access
|
Observed (listings)112
|
|
Initial Access
|
T1566.004 Spearphishing Voice
|
Observed113
|
|
Initial Access
|
T1200 Hardware Additions; T1091 Removable Media
|
Observed (victim-confirmed)114
|
|
Initial Access
|
T1199 Trusted Relationship (contractor pretext)
|
Planned115
|
|
Stealth
|
T1684.001 Impersonation
|
Observed116
|
|
Command and Control
|
T1219 Remote Access Tools (AnyDesk, Zoho, Quick Assist)
|
Observed117
|
|
Collection
|
T1005 Data from Local System
|
Observed118
|
|
Exfiltration
|
T1052.001 Exfiltration over USB
|
Observed (victim-confirmed)119
|
|
Exfiltration
|
T1567.002 Exfiltration to Cloud Storage
|
Observed120
|
|
Impact
|
T1657 Financial Theft
|
Observed121
|
Most of the group’s higher-harm activity (building entry with forged badges, bribing staff, sexual coercion, kidnapping plans, recruiting service members) has no Enterprise ATT&CK technique. Defenders should model it with physical security and insider threat frameworks.
-GRIT
Conclusion
This chat shows an extortion crew that treats the help desk call, the lobby and the partner’s own keyboard as its attack surface. It earns, by its own records, eight-figure sums while spending little, because the work is done by people rather than code. Three points stand out for defenders:- Controls built for malware and exploits sit beside this threat rather than in front of it. Verification, physical access, removable media and leadership readiness are the controls that matter related to mitigating this threat actor group behavior.
- The data does not always go away when the victim pays. The crew’s own words say its agents can keep it and they have no control over whether they do.
- The operation was still adapting at the end of the data. September 2026 is the second-highest month in the ledger ($68 million claimed) and the same month a second brand launched on new servers, bought network access to build credibility and told its first victims not to call the police.
-GRIT
Appendix A: Indicators
Treat as retrospective; infrastructure may have been reassigned or abandoned. Exact lookalike domains for specific firms are withheld here until those firms are notified.|
Type
|
Value
|
Context
|
|---|---|---|
|
Domain
|
aim6umein3kee[.]com
|
Primary Rocket.Chat server
|
|
Domain
|
slplsskdj2836v2jjsx[.]com
|
"Sleepless" spin-off Rocket.Chat server (from September 2, 2026)
|
|
Domain
|
sleepless[.]co, sleeplessthreat[.]com, threatactorsneversleep[.]com
|
Candidate brand domains discussed September 2, 2026; registration not confirmed122
|
|
Domain
|
sokolovsky-law[.]com, ominetdata[.]com, develevenor[.]com, funconnect[.]com
|
Pretext domains and mailboxes, August to September 2025123
|
|
IPv4
|
45[.]32[.]232[.]133 (port 2895)
|
RDP host labeled "SLEEPLESS RDP WORK" 124
|
|
IPv4
|
199[.]217[.]98[.]21, 216[.]203[.]20[.]157
|
SSH "shell" servers, 600 GB each 125
|
|
IPv4
|
87[.]251[.]67[.]222, 87[.]251[.]67[.]223
|
Servers delivered with root access in September 2025; role unstated 126
|
|
IPv4
|
66[.]179[.]31[.]122
|
RDP host used for the brand's social-media account127
|
|
Pattern
|
-it[.]com, it-[.]com, -law[.]com
|
One lookalike with an issued mailbox128 one requested,129 one proposed130
|
|
Infrastructure
|
3CX PBX on Netherlands VPS
|
Telephony for MAIN131
|
|
Services
|
T1219 Remote Access Tools (AnyDesk, Zoho, Quick Assist)
|
Tooling named in the chats
|
|
Crypto
|
65 distinct Bitcoin addresses
|
Withheld here; available to investigators on request
|
Notes
Numbered notes cite the leaked chat export by message ID, date and speaker. View sources >
Lauren Brennan is a Principal Threat Intelligence Consultant on GuidePoint Security’s Research and Intelligence Team (GRIT), where she engages in threat actor communications, dark web research, tracks ransomware and extortion groups and develops detections and threat research on behalf of the firm and its clients. Her career background includes security operations program development, threat intelligence and incident response in the private sector.
Before joining GRIT, Lauren led GuidePoint’s Security Operations Center Optimization team, where she directed more than 30 security operations maturity assessments for commercial clients, including several Fortune 500 companies. In that role and as a Senior Security Architect, she evaluated client detection coverage against the MITRE ATT&CK framework, assessed threat intelligence programs against the intelligence lifecycle and developed more than 10 proprietary maturity assessment services for organizations in the finance, manufacturing and energy sectors.
Prior to GuidePoint, Lauren spent three years at VISA as a Cybersecurity Analyst, producing threat intelligence reporting for internal stakeholders, briefing executive leadership and risk oversight committees and facilitating more than 180 internal security and risk assessments each year.
Lauren is a frequent speaker on security operations and threat intelligence, including at MITRE ATT&CK® CON 4.0 and is a contributing member of the Curated Intelligence community. She holds a Master of Science in Informatics from San Jose State University, where she is currently pursuing a Master of Science in Library Science, a Bachelor of Arts in Political Science from North Carolina State University and several industry certifications.