Silent Ransom Group Now Walks Into Law Firm Lobbies. No Ransomware Required.

A law firm's front desk gets a call from someone who sounds exactly like the IT vendor on the maintenance contract. When that does not work, the caller does not give up. Weeks later, someone in a polo shirt with a laminated badge walks in, tells the receptionist they are there to image a workstation for a security issue, and leaves twenty minutes later with a USB drive full of client files. No malware ran. No ransomware note appeared. Nothing tripped the endpoint agent, because nothing needed to.

This is the current playbook of Silent Ransom Group, tracked by Google's Mandiant Threat Intelligence Group as UNC3753 and also known as Luna Moth and Chatty Spider. The FBI issued a Flash alert about the group's IT-impersonation vishing campaign against law firms on May 26, and by June, both Mandiant and the ransomware-intelligence firm Halcyon had confirmed the group's newest escalation: when the phone call does not land, an operator shows up in person. Here is who this affects and who can stop reading. If your company has no public phone number an employee is expected to answer on behalf of IT, and every endpoint is already locked to an approved remote-access allowlist enforced by policy rather than trust, this specific group's opening move is already closed to it. Everyone else, and especially any firm holding client records, deal documents, or case files that would be worth extorting over, is exactly who Mandiant is describing.

What Silent Ransom Group actually does when the call connects

The campaign starts with an invoice-themed email from a consumer address, no link, no attachment, just enough of a pretext to make the follow-up phone call plausible. The caller impersonates the internal IT helpdesk or a security team member and asks the target to start a screen-sharing session, usually through Zoom, Microsoft Teams, Quick Assist, or Microsoft's built-in remote tools. Once inside, the actor talks the target into installing a legitimate remote-monitoring tool, commonly AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM, delivered through a one-line install command. Mandiant's report documents the whole sequence completing inside a single business day, with the actual data search, staging, and theft sometimes finished in under an hour.

From there the operator pivots into whatever the compromised session can reach: mapped network drives, OneDrive, and document-management systems like iManage, where they run keyword searches for W-2s, W-9s, audit files, and signed agreements. Exfiltration goes out through consumer cloud storage, or through WinSCP and Rclone straight to actor-controlled infrastructure. Mandiant's report cites one case where the group pulled 1.7 gigabytes through Google Drive and another 14.4 gigabytes through WinSCP from the same target. The extortion email, unbranded and threatening to notify clients, employees, and partners or post the data to a leak site, typically arrives within thirty minutes of the operator logging off. Victims get a three-day window to respond. Halcyon's reporting on this campaign cites a twenty-million-dollar demand against a single law firm in May.

The tactic that just escalated: someone walks through your front door

Vishing that fails does not end the attempt anymore. Halcyon's June alert and Mandiant's report both describe the group sending an operator to the target's physical office, posing as an IT technician there to image a device or resolve a security issue. Once inside, the actor plugs directly into a workstation and copies data to a USB drive, sidestepping every network control built to catch remote exfiltration. This is a genuinely old tactic, physical social engineering predates most of the security stack built to stop it, and its return says something specific: the group has learned that a well-run law firm's network perimeter is harder to talk past than its reception desk.

The reason this matters beyond law firms is straightforward. Any organization that lets an unverified caller reach an employee who can install software, and any organization where a person who claims to be a technician can get past the front desk without anyone checking a name against a scheduled work order, has both of the openings this group is currently walking through. Professional services firms logged more ransomware and extortion incidents in the first half of 2026 than any other sector. Vendors like SonicWall point to concentrated, sensitive client data and the pressure these firms face to resolve an incident quietly and fast, not exotic malware, as the reason attackers keep coming back to this sector.

Shut the phone-based front door

The fix here is process, not a product purchase. Every employee needs a way to verify an unsolicited IT call that does not depend on trusting the caller's own claims about who they are.

Three controls that stop this before a session ever opens

• Callback verification through a number the employee already has, not one the caller supplies. IT support should never initiate an unscheduled call asking someone to install software. If a call like that arrives, the employee hangs up and calls the helpdesk back on the number in the internal directory, not any number given during the call.
• Application allowlisting for remote-access and screen-sharing software. Block installation of anything outside an approved RMM tool through your endpoint platform or Group Policy. An employee talked into running an installer should hit a policy wall, not a successful install.
• A named, current allowlist your helpdesk and your users both know. If your approved tool is ConnectWise Control or a specific RMM platform, that name should be common knowledge across the company, so anything else offered during a call is an immediate red flag rather than an ambiguous judgment call.

Audit what is already installed before you write the policy. This pulls every machine's installed programs against Mandiant's published tool list and flags anything that is not on your approved allowlist:

# Inventory remote-access / RMM software installed on this host and flag
# anything outside your approved allowlist. Push via GPO startup script or
# your existing RMM's script deployment; safe to run unattended.

$approved  = @('ConnectWise Control', 'Your Approved RMM Name')
$watchlist = @('AnyDesk','Bomgar','BeyondTrust Remote Support','Zoho Assist',
               'SuperOps RMM','Splashtop','TeamViewer','ScreenConnect')

$paths = @(
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

Get-ItemProperty $paths -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -and ($watchlist -contains $_.DisplayName) -and
                 ($approved -notcontains $_.DisplayName) } |
  Select-Object DisplayName, DisplayVersion, InstallDate,
    @{N='Computer';E={$env:COMPUTERNAME}} |
  Export-Csv "\\fileserver\security\rmm-audit-$(Get-Date -Format yyyyMMdd).csv" `
    -Append -NoTypeInformation

Run it fleet-wide once, then again after you roll out the allowlist policy. The gap between the two runs is your actual exposure right now, not the exposure you assume you have.

Shut the actual front door

Physical access controls get skipped at small and mid-size firms more often than any network control, because the threat model most IT teams plan for stops at the edge of the building.

What the front desk needs before the next unscheduled visitor

• Verify against a pre-scheduled work order, every time. A technician who was not on a list the office manager already had that morning does not get access, regardless of how legitimate the badge or the story sounds.
• Photo ID logged, not just glanced at. Record the ID and the stated purpose for every non-employee who enters a space with network access.
• An escort for the entire visit. Vendor technicians do not get unsupervised time at a workstation, full stop, regardless of how routine the task sounds.
• USB storage disabled by default. Block removable media through Group Policy or your endpoint platform on any machine that does not have a documented business reason to allow it. This closes the exact exfiltration path the in-person tactic depends on.

What the exfiltration looks like before the extortion email arrives

Because there is no ransomware binary and no file encryption, the signal you are actually looking for is a burst of data movement that does not match how the account normally behaves. Mandiant's report gives you the specific shape of it: rapid, repeated keyword searches inside a document-management system like iManage or SharePoint, immediately followed by mass downloads from the same account, then an outbound transfer through WinSCP, Rclone, or a consumer cloud-storage client the account has never used before. Any one of those alone might be nothing. All three inside the same hour, from an account that logged in from a new device today, is the pattern.

If you run a SIEM, three detections cover most of this without new tooling. Alert on SSH or SFTP connections initiated from a workstation that has never made one, since WinSCP and Rclone both ride on that protocol. Alert on a spike in document downloads or search-term volume from a single user account inside your document-management or file-share platform, correlated against that same account's login history for anything unfamiliar. And alert on outbound connections to personal cloud-storage domains, Google Drive, Dropbox, and similar, from any endpoint that is not already an approved integration. None of these require a new product. They require someone to have written the rule before the account got talked into a screen-sharing session, because Mandiant's own numbers put the gap between exfiltration and the extortion email at about thirty minutes. That is not enough time to build a detection from scratch after the fact.

Verify the caller, verify the visitor before you verify anything else

Neither of these controls costs much, and neither depends on a new product. What they cost is the discipline to make "no" the default answer to an unverified request, whether it arrives by phone or in person, until someone confirms it against a record that already existed before the request did. Because this campaign leaves no ransomware binary and no encryption event, your existing detections were built to watch for the wrong thing. The callback policy and the visitor log are what actually stand between Silent Ransom Group's next call and your client files.