Silent Ransom Group does not need malware or a software flaw. It needs one person at your firm to believe that the caller on the line is from IT. The FBI says the group has been doing exactly that to law firms since 2023.
What happened
On 23 May 2025, the FBI issued a notice warning that Silent Ransom Group, also tracked as Luna Moth and Chatty Spider, had been targeting mainly US law firms since spring 2023. A year later, on 26 May 2026, it issued a second, more detailed alert describing the same methods and new ones, and noting that the group had expanded to insurance, finance and healthcare.
The consequences are now visible in court. According to Bloomberg Law, Fox Rothschild was hit by an attack on 21 May 2026 that the firm's security chief described as an "advanced social engineering incident" aimed at one attorney and confined to a single device. On 9 June 2026, a proposed class action was filed in the Eastern District of Pennsylvania, alleging that names and Social Security numbers were exposed and citing research attributing the attack to Silent Ransom Group. Earlier in 2026, data from Jones Day appeared on a leak site linked to the same group.
How the attack works
The FBI describes two main routes in:
- Callback phishing. An email warns of a small subscription charge and gives a phone number to cancel it. The person who calls is talked into installing remote access software.
- Fake IT support. Since April 2025, the group has also phoned staff directly while posing as the firm's IT department. In some cases it has followed up with in-person visits to plug a storage device into a computer.
Once inside, the attackers copy data out quickly with ordinary file transfer tools, cloud storage or USB drives. They then demand payment by email and by calling employees, and according to the 2026 alert, by contacting the firm's clients to increase the pressure.
The FBI lists warning signs including unexpected installations of remote access tools such as Zoho Assist, AnyDesk, Splashtop, Syncro and Atera.
Why it matters for your organisation
Every element of this attack exploits something normal in professional services. Fee earners are busy and helpful, they rely on IT support they rarely meet, and they hold exactly the kind of data that clients will pay to keep private. Calling clients directly turns a security incident into a relationship crisis.
What to do now
The FBI's own recommendations are a good baseline. In its words: "Develop and communicate policies surrounding when and how company's IT will authenticate themselves with employees" and "Verify the credentials of all individuals accessing firm spaces." In 2026 it added phishing-resistant MFA, copying visitors' ID, and disabling remote access and external drives on computers that hold sensitive data.
- Write down how IT contacts staff, and tell everyone. If a call does not follow the rule, staff hang up and call back on a known number.
- Block unapproved remote access tools so that a persuaded user cannot install one.
- Alert on bulk data transfers to cloud storage, USB or unfamiliar destinations.
- Brief reception and office staff on visitors claiming to be from IT.
- Prepare a client communication plan in case attackers contact clients before you do.
How Blacknote helps
Our Human Risk & Security Awareness sessions train partners and staff to recognise exactly these calls and emails, using realistic scenarios rather than generic slides. Combined with infrastructure hardening, we make sure that a single convinced employee cannot hand over the firm's data.
Sources
- FBI FLASH-20260526-01: Silent Ransom Group (26 May 2026)
- FBI Private Industry Notification 20250523-001 (23 May 2025)
- BleepingComputer: FBI warns of Silent Ransom Group in-person data theft attacks
- Bloomberg Law: Fox Rothschild sued after alleged SilentRansomGroup cyberattack
- ABA Journal: Jones Day phishing incident