Silent Ransom Group Escalates Attacks on U.S. Law Firms with IT Impersonation Scheme A sophisticated cyber extortion syndicate known as the Silent Ransom Group (SRG) also tracked as Luna Moth, Chatty Spider, and UNC3753 has intensified its campaign against U.S. law firms since early 2023, employing aggressive social engineering tactics to bypass traditional cybersecurity defenses. Unlike conventional ransomware operators, SRG avoids file-locking malware, instead focusing on rapid data exfiltration and high-pressure extortion. The group steals sensitive information, threatens to publish it on its leak site (business-data-leaks.com), and even contacts victims’ clients to coerce ransom payments. As of Spring 2026, SRG has adopted a localized IT support impersonation scheme, initiating contact via phishing emails or direct calls to employees. Attackers pose as internal IT staff, convincing victims to install legitimate remote administration tools (e.g., AnyDesk, TeamViewer) to gain access. If digital methods fail, SRG escalates to physical intrusion, dispatching operatives to offices under the guise of IT personnel. These attackers claim to resolve security alerts by inserting USB drives or external hard drives into target systems to manually extract data. Once inside, SRG minimizes privilege escalation, swiftly exfiltrating stolen files to cloud platforms (Google Drive, Microsoft OneDrive) or external servers using tools like WinSCP and disguised Rclone. Because the group leverages valid software and cloud environments, traditional antivirus solutions often fail to detect intrusions. The FBI’s May 2026 FLASH report highlights SRG’s reliance on callback phishing (T1566), voice phishing (T1598.004), and abuse of remote access tools (T1219). Organizations are advised to report incidents to the FBI, preserving ransom notes, phishing emails, and surveillance footage to aid investigations. Behavioral monitoring, strict access controls, and physical security measures are critical to mitigating this threat.