Silent Ransom Impersonates IT Support to Target Law Firms

The Silent Ransom Group (SRG) is running a new wave of hands‑on social engineering attacks against law firms, posing as internal IT support to steal sensitive data and extort victims without deploying traditional ransomware.

In its latest campaigns, SRG contacts employees directly by phone or lures them through phishing emails that appear to come from the firm’s own IT department. The attackers pressure targets to call a bogus helpdesk number, where a fake technician walks them through granting remote desktop access under the pretext of fixing an urgent issue.

If this remote access attempt fails, SRG escalates to an in‑person intrusion by sending someone physically to the office, claiming they need to “image” a workstation or create a backup to recover from a supposed phishing incident.

Once at the machine, the intruder connects an external hard drive or USB device to copy data quietly.

Unlike classic ransomware crews, SRG skips file encryption and goes straight to data theft and extortion. After gaining a foothold, the operators perform only minimal privilege escalation before rapidly exfiltrating documents, emails and case files.

They rely heavily on legitimate remote administration and file transfer utilities, including WinSCP and hidden or renamed versions of Rclone, to move data out to attacker‑controlled infrastructure or cloud platforms such as Google Drive and Microsoft OneDrive. In on‑site scenarios, stolen information is copied directly to removable media attached to the victim’s system.

According to FBI, the tracked as Luna Moth, Chatty Spider, and UNC3753, the group has focused on US‑based legal practices since spring 2023, while also impacting insurance, finance, and healthcare organizations.

Once data exfiltration is complete, victims receive ransom emails threatening to sell or publish files online if they refuse to pay. SRG actors may also call employees or even clients to increase pressure and force negotiations.

The group maintains a leak site at business-data-leaks[.]com, where they have posted victim data to prove their claims.

Silent Ransom Impersonates IT

Recent SRG operations leave few artifacts on compromised machines because the group leans on tools that many organizations already use for legitimate IT support.

Traditional antivirus products are unlikely to flag these activities by default, making behavioral monitoring and context critical for detection.

Key warning signs include unexpected installations of remote access tools such as Zoho Assist, Quick Assist, AnyDesk, Remote Desktop, Syncro, Splashtop, or Atera; unusual connections from WinSCP or Rclone to external IP addresses; and sudden spikes in data transfers to OneDrive, Google Drive, or other external servers.

Physical red flags include unknown individuals attempting to access workstations while claiming to be IT staff, as well as unsolicited calls or emails stating that company or client data has already been stolen.

Law firms are urged to tighten both digital and physical access controls to counter this blend of social engineering and hands‑on intrusion.

The FBI recommends verifying the identity of every visitor, limiting access to sensitive systems from home or public networks, and clearly documenting how legitimate IT staff will contact and authenticate themselves to employees.

Routine security awareness training should coach staff to question unexpected IT requests, refuse to install remote tools on demand, and immediately report suspicious calls or office visitors.

Firms should also enforce phishing‑resistant multi‑factor authentication, maintain regular offline backups, restrict remote access and USB use on high‑value systems, and, where possible, block port 22 to reduce exposure to unauthorized encrypted remote sessions.

Given SRG’s continued focus on legal organizations and its ability to blend into normal IT operations, law firms that rely heavily on remote support and cloud collaboration should review their processes now, before a fake “IT technician” walks through the door.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.