Silent Ransom Group: Fake IT Workers, Phone and In Person, Are Targeting Law Firms

On May 26, 2026, the FBI issued a FLASH alert warning that the Silent Ransom Group is impersonating corporate IT staff to get into victims' computers, and that when remote access fails, the group sends a person to the victim's office to plug a storage device into a workstation. The FBI says the group has consistently targeted U.S. law firms since 2023.

On June 5, 2026, Google's Threat Intelligence Group and Mandiant published a report on the same group, which they track as UNC3753 (also known as Luna Moth and Chatty Spider). It describes a campaign against dozens of U.S. legal, financial, and professional services organizations between January and May 2026. Google notes that the in-person attempts were made by potentially related actors and are consistent with the FBI alert.

How the attack works

It usually starts with an invoice-themed email sent from a consumer email account, followed by a phone call from someone claiming to be the firm's IT support. The caller asks the employee to share their screen or install a remote support tool such as AnyDesk or Zoho Assist. From there the attackers go straight for document management systems and cloud storage, and Google reports that some intrusions ran from first call to data theft within a single business day.

This group does not lock your files. It steals them and then demands payment, threatening to sell or publish the data and, in some cases, contacting employees or clients to raise the pressure. Backups do not help with that kind of extortion. Keeping the data from leaving does.

Why small firms are exposed

Client files are exactly what this group wants: privileged communications, financial and tax records, medical records, Social Security numbers, settlement terms. A firm with no receptionist, no badge system, and an IT provider nobody at the front desk has ever met is the easiest kind of target for a confident stranger who says they are there to fix the computers.

Under the professional conduct rules in Florida and most other states, lawyers must make reasonable efforts to prevent unauthorized access to client information. We are not lawyers and this is not ethics advice, so confirm your obligations with ethics counsel or your bar's resources. Operationally, the point is simple: a breach that walks in the front door is still a breach.

What to put in place this week

Agree on a verification step with your IT provider. Every legitimate support call or visit is confirmed by calling the provider back at a number you already have on file, never one the caller gives you, and nobody touches a workstation without a ticket you can see.

Tell every person in the office, including part-time staff, how this group operates: an unexpected call or visit from "IT," a request to share a screen, install a tool, or back up or image a device. The FBI lists unidentified people claiming to be IT support, and unfamiliar USB or external drives on office computers, as warning signs.

Restrict who can install remote access software, block or alert on USB storage where you can, and turn on multi-factor authentication for email, document management, and cloud storage. Then confirm that your cyber insurance covers data theft and extortion, not only ransomware encryption.

Where we can help

A security baseline review looks at the gaps this campaign exploits: how your IT provider is verified, what remote tools are installed, where client files live, and who can reach them. Request one at /audit. This article summarizes published government and industry threat reporting and general professional-conduct principles; it is not legal advice.