FBI warns Silent Ransom Group is posing as IT helpdesks — and walking operatives into US law firms
The FBI warned in a May 26 advisory that the Silent Ransom Group (SRG) — the data-theft extortion crew also tracked as Luna Moth, Chatty Spider and UNC3753 — has "consistently targeted U.S.-based law firms" and has recen.
At a glance
- FBI advisory (dated May 26, widely covered May 27) says Silent Ransom Group, aka Luna Moth/Chatty Spider/UNC3753, has consistently targeted US-based law firms
- SRG actors impersonate IT department staff via direct calls and phishing emails, then direct employees to grant remote desktop sessions
- When remote access fails, SRG sends a threat actor to the victim's physical location to insert a storage device into a computer
- The group extorts victims by threatening to release or sell stolen data rather than encrypting systems
- TechTimes reported SRG's leak site already lists 38 law firms
VERDICT — CONFIRMED
The FBI warned in a May 26 advisory that the Silent Ransom Group (SRG) — the data-theft extortion crew also tracked as Luna Moth, Chatty Spider and UNC3753 — has "consistently targeted U.S.-based law firms" and has recently begun posing as employees from victims' own IT departments, with the alert rippling through the legal and security trade press on May 27. According to the bureau, SRG actors either call employees directly or send phishing emails urging recipients to contact someone posing as IT support; once on the phone, the actor directs the employee to grant access to a remote desktop session.
If that fails, the FBI says, the group escalates dramatically — sending a threat actor to the victim's physical location to gain access and insert a storage device into a computer. Rather than encrypting systems, SRG then threatens to release or sell the stolen data online unless a ransom is paid.
TechTimes reported on May 27 that the group's leak site already lists 38 law firms. The FBI recommends that firms verify the credentials of anyone seeking access to office space or computer systems, train staff to recognize phishing, maintain regular backups and require multifactor authentication.
Why it matters
an FBI flash confirming that an extortion crew is physically walking operatives into U.S. law offices marks a rare escalation from social engineering to in-person intrusion against the legal sector's most confidential data.
Key facts on file
- FBI advisory (dated May 26, widely covered May 27) says Silent Ransom Group, aka Luna Moth/Chatty Spider/UNC3753, has consistently targeted US-based law firms
- SRG actors impersonate IT department staff via direct calls and phishing emails, then direct employees to grant remote desktop sessions
- When remote access fails, SRG sends a threat actor to the victim's physical location to insert a storage device into a computer
- The group extorts victims by threatening to release or sell stolen data rather than encrypting systems
- TechTimes reported SRG's leak site already lists 38 law firms
