Silent Ransom Group Uses Fake IT Support Calls to Target Law Firms
Summary
Mandiant says the Silent Ransom Group targeted dozens of organizations with invoice-themed phishing and fake IT support calls, then stole sensitive data for extortion. The FBI also warned of in-person theft attempts.
Key points
- Mandiant says the group, also tracked as UNC3753, Luna Moth, and Chatty Spider, targeted dozens of legal, financial, and professional services organizations from January to May 2026.
- Attacks begin with invoice-themed emails from consumer accounts, followed by calls impersonating IT staff and remote support sessions.
- The attackers reportedly use remote access tools including AnyDesk, Zoho Assist, Bomgar, and SuperOps to gain network access.
- The group seeks sensitive legal and financial files and reportedly exfiltrates data with tools such as WinSCP or Rclone, rather than relying on traditional ransomware encryption.
- Mandiant says extortion demands can arrive within 30 minutes of the attackers leaving an environment, with a three-day response deadline and threats to contact clients.
- Mandiant identified phishing domains imitating IT portals and says attackers use privnote[.]com to share links and commands during support sessions.
- The FBI warned of possible in-person data theft attempts; Mandiant said forensic evidence was limited but considered them likely linked based on similarities in targeting and behavior.
Article Details
- Event Type
- Data-theft extortion campaign using invoice-themed phishing, IT-support impersonation, and remote-access abuse
- Impact
- Mandiant reports that the group targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026. Stolen data may include contracts, tax records, Social Security numbers, and merger and acquisition files. The group threatens to contact victims’ employees and clients and reportedly gives organizations three days to respond to extortion demands.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | business-data-leaks[.]com | Resecurity linked this data-leak site and related infrastructure to the Silent Ransom Group. |
MITRE ATT&CK
Threat Actors
Silent Ransom GroupMandiant and the FBI report that the group targets U.S. law firms and other organizations using social engineering, data theft, and extortion.UNC3753Mandiant tracks the Silent Ransom Group as UNC3753 and reports that the group conducts social-engineering intrusions and data-theft extortion. Mandiant says in-person data-theft attacks are likely linked to UNC3753, based on similarities in targeting, timelines, and behavior.
Products
Microsoft Quick AssistThey impersonate IT support and use remote tools like Teams, Zoom, and Quick Assist.Microsoft TeamsIn the current campaign, the Silent Ransom Group impersonates IT help desks and convinces employees to join remote support sessions via Microsoft Teams, Zoom, Quick Assist, or Microsoft Terminal Services.Microsoft Terminal ServicesIn the current campaign, the Silent Ransom Group impersonates IT help desks and convinces employees to join remote support sessions via Microsoft Teams, Zoom, Quick Assist, or Microsoft Terminal Services.ZoomThey impersonate IT support and use remote tools like Teams, Zoom, and Quick Assist.
Tools
AnyDeskthe threat actors trick the target into installing remote monitoring and management tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, thereby granting them initial access to the corporate network.Bomgartrick the target into installing remote monitoring and management tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, thereby granting them initial access to the corporate network.RCloneThe attackers commonly target document management platforms and cloud storage repositories before exfiltrating the data using tools such as WinSCP or Rclone.SuperOpstarget into installing remote monitoring and management tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, thereby granting them initial access to the corporate network.WinSCPThe attackers commonly target document management platforms and cloud storage repositories before exfiltrating the data using tools such as WinSCP or Rclone.Zoho Assistthreat actors trick the target into installing remote monitoring and management tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, thereby granting them initial access to the corporate network.