FBI Warns U.S. Law Firms About Silent Ransom Group’s In-Person Data Theft
Summary
The FBI warned that Silent Ransom Group targets U.S. law firms with fake IT support calls and phishing, and may send an associate to attach a storage device when remote access fails. The group reportedly steals data without encrypting systems.
Key points
- The FBI warned that Silent Ransom Group continues to target U.S. law firms.
- The group impersonates IT support through phone calls and phishing to prompt employees to engage with an associate.
- If remote access attempts fail, the group may send an associate to a victim’s location to attach a storage device to a workstation.
- The group focuses on data theft and extortion rather than deploying encryption, according to the article.
- Researchers say the group has claimed responsibility for more than 100 attacks; this is a group claim, not independent confirmation of each incident.
- The group is also tracked as Chatty Spider, UNC3753, and Storm-0252.
Article Details
- Event Type
- FBI warning about a data-extortion group targeting U.S. law firms through impersonation, phishing, and in-person visits.
- Impact
- The FBI says Silent Ransom Group continues to target U.S.-based law firms and may send an associate to attach a storage device to a victim's workstation if remote access fails. Researchers say the group has claimed responsibility for more than 100 attacks. Halcyon tracked 134 ransomware incidents against law firms and legal services in the first quarter of this year, accounting for more than 6% of the ransomware attacks it tracked; researchers attributed much of that increase to Silent Ransom Group and Inc. The article says data theft creates privilege and reputational risks for law firms and that the group does not deploy encryption.
MITRE ATT&CK
T1566 · PhishingThe group uses phishing emails to prompt employees to contact an associate posing as IT support.T1566.004 · Spearphishing VoiceThe FBI says the group uses phone calls as part of its social-engineering scheme, prompting employees to call an associate posing as IT support.T1656 · ImpersonationThe group impersonates IT support in calls and phishing emails to gain access to employees' computers.
People
Allan LiskaRecorded Future's field chief information security officer; he discussed the group's focus on law firms and suggested it uses freelance taskers.Cynthia KaiserSenior vice president at Halcyon's Ransomware Research Center; she discussed the group's targeting of law firms and the impact of data theft on them.Ian GrayFlashpoint's vice president of cyber threat intelligence operations; he said Flashpoint had not observed attackers being physically sent to victim locations.Joe SlowikDataminr's director of cybersecurity alerting strategy; he commented on workplace trust and the human factors exploited by the group's approach.
Threat Actors
INCThe article says Silent Ransom Group and Inc were largely responsible for an increase in ransomware incidents against law firms and legal services; it describes Inc as a ransomware-as-a-service operation.Silent Ransom GroupThe FBI says the group targets U.S. law firms using impersonation, phishing, and sometimes in-person visits to steal data. Researchers say it has claimed responsibility for more than 100 attacks. The article says it is also tracked as Chatty Spider, UNC3753, and Storm-0252.UNC3753The article identifies UNC3753 as another tracking name for Silent Ransom Group, which the FBI says targets law firms to steal data.