The Silent Ransom Group (tracked as UNC3753, Luna Moth, Chatty Spider) targets U.S. law firms and professional services via social engineering campaigns that begin with invoice-themed phishing emails lacking malicious payloads. These emails prompt victims to call back attackers impersonating IT staff, who then conduct remote support sessions using platforms like Microsoft Teams or Zoom. During these sessions, attackers convince victims to install remote monitoring and management tools (e.g., AnyDesk, Zoho Assist), gaining initial network access. The group searches for sensitive documents on document management and cloud storage platforms, exfiltrating data using tools such as WinSCP or Rclone. Extortion demands follow rapidly, with a three-day deadline and threats to notify clients and regulators. The group also uses fast-flux DNS infrastructure to protect its leak sites. The FBI has reported related in-person data theft attempts. The group evolved from Ryuk and Conti ransomware affiliates and now focuses solely on data theft extortion.

The threat actor gains unauthorized remote access to corporate networks of law firms and professional services organizations, leading to theft of highly sensitive client and corporate data including contracts, tax records, Social Security numbers, and merger/acquisition files. The rapid extortion demands and threats to expose stolen data pose significant reputational and regulatory risks to victims. The attacks can result in data breaches with potential legal and financial consequences. The use of fast-flux infrastructure complicates takedown efforts of the group's leak sites. The FBI's report of in-person data theft attempts further increases the risk of physical compromise of sensitive data.

No official patch applies as this is a social engineering and operational threat rather than a software vulnerability. The FBI and Mandiant recommend implementing strict verification procedures for all IT support interactions to confirm legitimacy before granting access. Organizations should limit the use of remote access tools and enforce multi-factor authentication (MFA) to reduce unauthorized access risk. Employee training to recognize voice phishing and callback phishing tactics is critical. Restricting USB storage device usage can help mitigate in-person data theft risks. These mitigations address the specific tactics used by the Silent Ransom Group as described in the vendor advisory.