Skip to content

Silent Ransom Group's sustained, FBI-named campaign against US law firms

Signal card · maintained from public sources · last updated 2026-10-29

CategoryThreat-Actor Behaviour
StatusStrengthening
Confidence🟨
First observed2026-02-01
Last updated2026-10-29

Overview

Re-opened after a premature retirement. A watchlist line on ransomware/extortion specialization in the legal sector was seeded 2026-09-06 and retired 2026-10-05 for lack of "a second ransomware group explicitly targeting Am Law/Magic Circle firms, and no CISA/FBI advisory on law-firm targeting" after ~29 days. Both conditions the retirement cited were already satisfied at the time: the FBI issued a FLASH advisory (FLASH-20260526-01, May 26 2026) naming Silent Ransom Group (aka Luna Moth, Chatty Spider, UNC3753) as the actor behind a sustained campaign against US law firms dating to spring 2023 — using fake-IT-support phone calls, phishing, and in some cases in-person office visits to get initial access, then exfiltrating data via WinSCP/renamed Rclone for extortion without relying on encryption. This is a single, authoritatively-attributed actor, not a second group independently discovering the same vertical — but the FBI naming is itself the structural confirmation the original "watch for" asked for, and it predates the watchlist seed by over three months, meaning the retirement was a research gap, not an absence of evidence.

Since the FBI advisory, named Am Law-caliber firms have confirmed incidents or been named in regulator filings/class actions across eight months: Orrick Herrington & Sutcliffe (Feb 2026), Porter Wright & Fox Rothschild (May 2026), Holland & Knight and Greenberg Traurig and Katten (early Sep 2026), Sheppard Mullin Richter & Hampton (attack occurred August, disclosed to the California AG Oct 2, now facing a federal class action), and a claimed-but-unconfirmed Latham & Watkins listing (Oct 19) — plus aggregator-only, unconfirmed claims against Riker Danzig, Hogan Lovells/Cadwalader and Squire Patton Boggs in the same window. This is the "connective pattern across time" SIG-13 is designed to catch — a single actor, named by the FBI, recurring against a specific professional-services vertical for over three years, with multiple firm-confirmed or regulator-filed instances independent of any leak-site claim.

Evidence log

  • 2025-05 / 2026-05-26 — FBI FLASH advisory (authoritative attribution). The FBI issued FLASH-20260526-01 (a renewed warning; an earlier private-industry notification dates to May 2025) naming Silent Ransom Group/Luna Moth/Chatty Spider/UNC3753 as consistently targeting US law firms since spring 2023 via fake-IT-support social engineering (phone, phishing, and physical office visits/USB drops), exfiltrating data with WinSCP and a hidden/renamed Rclone binary, then extorting without encryption. HSToday · vpncentral · SOFX

  • 2026-02 — Orrick Herrington & Sutcliffe discloses a cyber incident affecting client data (named in prior desk research; precedes the FBI's renewed May advisory). Cybernews

  • 2026-05 — Porter Wright and Fox Rothschild both disclose incidents in the same window the FBI advisory went out. Cybernews

  • 2026-09-08 — Holland & Knight and Greenberg Traurig both confirm cyber incidents; Greenberg Traurig files notice with the Vermont AG confirming SSNs exposed. Neither firm confirms SRG attribution specifically. Cybernews · MLex

  • 2026-09 — Katten discloses a social-engineering incident with limited client-file exposure, in the same reporting window. Cybernews

  • 2026-10-02 / 2026-10-09 — Sheppard Mullin Richter & Hampton discloses to the California AG (Oct 2) a cyberattack that occurred in August; a former paralegal (Pena-Emilia Williams) files a proposed federal class action (~Oct 9) alleging inadequate employee cybersecurity training, affecting at least 1,000 people. Firm has not publicly confirmed SRG attribution. MLex · USA Herald — independently verified via direct search 2026-10-29; both the Oct 2 AG disclosure and the Williams class action confirm.

  • 2026-10-19 — Latham & Watkins claimed on a leak site; firm has not confirmed. Weaker/claim-only data point, included for completeness, not as a confirmed instance. Cybernews

  • 2026-10-29 — Re-opened directly to a card (signal-scan recurrence-mining pass) rather than re-seeded on the watchlist, since the FBI attribution plus firm-confirmed/regulator-filed instances across eight months already clears the promotion bar the watchlist exists to build toward. HSToday

Assessment

Confidence: 🟨 Moderate. The FBI FLASH advisory is a strong, authoritative anchor for actor attribution and the sector-targeting pattern itself. Individual victim instances vary in sourcing quality — Greenberg Traurig and Sheppard Mullin are regulator-filed/court-filed (firm-confirmed incident, SRG attribution not firm-confirmed), while Latham & Watkins is claim-only. None of the named firms has publicly confirmed Silent Ransom Group as the specific actor behind their own incident, so the link between "FBI says SRG targets law firms" and "these specific firms were hit by SRG" rests on pattern-matching (same social-engineering MO, same target profile, same multi-month window) rather than firm-level confirmation. That gap keeps this at Moderate rather than High.

Estimate: Likely that at least one more Am Law 200-caliber firm discloses a comparable incident within the next quarter, given the campaign has run continuously since 2023 without a reported takedown or arrest. Roughly even chance the next disclosure surfaces via a state AG filing rather than a leak-site claim, consistent with SRG's data-theft-without-encryption model.

Watch for: a named law firm or the FBI/DOJ explicitly confirming Silent Ransom Group as the attributed actor behind one of the above incidents (closing the pattern-matching gap); a law-enforcement action (arrest, infrastructure seizure) against SRG/Luna Moth; a sixth or later Am Law-caliber firm disclosure in the same window; any CISA/FBI follow-up advisory updating the May 2026 FLASH.

Portfolio relevance: Law firms hold concentrated, high-value client data (M&A diligence, litigation discovery, privileged communications) across every portfolio company's advisory relationships. A sustained, government-named campaign against the sector is a supply-chain-style exposure for any portfolio company whose outside counsel is a plausible target — incident-response and vendor-risk teams should treat "our law firm got a call from fake IT support" as a live scenario, not a hypothetical.

Sources

← All signals