Silent Ransom Group Targets US Legal Firms With Voice Phishing and Data Theft Extortion

A concentrated data theft extortion campaign by UNC3753 also reported as Luna Moth, Chatty Spider, and Silent Ransom Group targeting dozens of U.S. professional, legal, and financial services firms.

The cluster’s hallmark is fast, human-centric intrusions that combine voice phishing (vishing), social engineering, abuse of legitimate remote support tools, and in some cases physical office access to rapidly collect sensitive legal, financial, and personally identifiable information for immediate extortion.

UNC3753 initiates contact with benign-looking invoice or migration-themed emails sent from actor-controlled consumer accounts.

These messages contain no malware but establish a plausible pretext that primes recipients for follow-up phone calls.

Operators harvest publicly available employee names, phone numbers, and titles to impersonate internal IT or security staff and place direct calls.

Using scripted dialogue they convince targets to join screen-sharing sessions or to download remote monitoring and management (RMM) utilities, often instructing victims to run installers via transient messages delivered through self‑destructing text services such as privnote[.]com to minimize forensic traces.

Mandiant identified a financially motivated data theft extortion campaign executed by the threat cluster UNC3753 (also tracked as “Luna Moth,” “Chatty Spider,” and “Silent Ransom Group”).

Once a support session is established via Zoom, Microsoft Teams, Quick Assist, AnyDesk, Bomgar, Zoho Assist, or by installing commercial RMM agents the adversary either directly navigates the environment or coerces the employee to perform targeted searches.

Silent Ransom Group Targets US Legal Firms

The actors prioritize iManage, OneDrive, mapped network drives, and VDI-hosted corporate desktops, leveraging BYOD endpoints to pivot into corporate virtual desktops (Windows 365, Citrix) when necessary.

Mandiant observed entire attack lifecycles compressing into a single business day, with staging and initial exfiltration sometimes completed within an hour.

Data collection is surgical: keyword searches locate tax forms (W‑2, W‑9, 1099), SSNs, proprietary client agreements, and other high-value legal materials.

Exfiltration methods are pragmatic and adaptable browser-based uploads to actor-controlled consumer cloud accounts, portable WinSCP or Rclone binaries, FTP/SFTP transfers, or instructing victims to email archives to external addresses.

In one case UNC3753 uploaded 1.7 GB from OneDrive to Google Drive then exfiltrated an additional 14.4 GB via WinSCP; Google subsequently disabled the implicated accounts.

Following theft, UNC3753 issues aggressive extortion demands typically within 30 minutes threatening public disclosure on the LEAKEDDATA data leak site and warning of regulatory fines, client lawsuits, and reputational collapse.

Demands impose rapid three‑day deadlines and threaten to contact clients and employees directly to maximize pressure.

The group’s earlier operations included ransomware deployment (LOCKBIT.BLACK in 2022), but recent activity has prioritized pure data theft and extortion.

Mandiant and Google Threat Intelligence attribute the campaign to UNC3753 based on infrastructure overlaps, victimology, and operational patterns; the FBI has also issued a Cyber FLASH alert documenting related physical access attempts where individuals posing as technicians sought to copy data to USB drives.

Those in‑person incidents reflect a concerning escalation that bypasses digital telemetry and underscores weaknesses in physical access controls.

Defensive priorities should therefore marry human-focused training with technical controls: targeted vishing awareness, strict out‑of‑band verification for technicians, visitor escorting and credential logging, blocking unapproved RMM and screen‑sharing binaries, conditional access limiting VDI and VPN to corporate devices.

Enforcing MFA on document repositories, enabling session-level logging with byte counts, and real‑time alerts for search‑term spikes in iManage or SharePoint reduce dwell and exfiltration risk.

The campaign exposes a persistent reality: skilled adversaries are weaponizing social trust and physical proximity to defeat perimeter defenses.

Legal and professional services firms, custodians of highly sensitive client data, must treat physical security and user behavior as equally critical to network hardening to blunt this rapidly evolving extortion threat.

Indicators of Compromise (IOCs)

IOC Type	Indicator
IPv4 Address	192.236.147.131
IPv4 Address	192.236.147.138
IPv4 Address	193.141.60.212
IPv4 Address	192.236.154.158
IPv4 Address	192.236.146.173
IPv4 Address	174.169.162.62
IPv4 Address	64.94.84.97

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.