Law Firms Are Under Attack: Inside the Silent Ransom Group Threat

Introduction

On 2 and 3 September 2026, a cyber extortion gang called Silent Ransom Group added Greenberg Traurig, one of the largest law firms in the world, to its dark-web leak site. The group threatened to publish the data it said it had stolen. Greenberg Traurig has not confirmed that the group is responsible or said what data it holds. Within weeks, though, the firm had reported the incident to US state regulators, confirmed that Social Security numbers were exposed, and was facing proposed class actions in federal court in Manhattan.

This is not a one-off. Law firm cyber attacks have been rising all year. The pattern behind them should worry every managing partner, COO and IT director in the legal sector, because the attackers are not breaking through firewalls. They are picking up the phone.

This article explains what has happened, who Silent Ransom Group is, how its attacks work, and the practical steps your firm can take now.

A Summer of Law Firm Data Breaches

The Greenberg Traurig incident is the latest in a series of publicly disclosed breaches at major firms in 2026:

• WilmerHale. On 8 May, an employee gave sensitive information to someone who had lied about their identity. Names and Social Security numbers were exposed. Notification letters went out in July, and a proposed class action was filed in Washington, DC.
• Quinn Emanuel. On 14 August, an attacker used social engineering to gain access to a single user account and reach what the firm called "a limited number of client documents", including litigation files.
• McDermott Will & Schulz. In late August, the firm disclosed a social engineering incident involving one user. It described it as isolated, but exposed files included Social Security numbers and health data.
• Herbert Smith Freehills Kramer and Goodwin. Both have also disclosed incidents to US state regulators.
• Greenberg Traurig. The firm notified the Vermont Attorney General on 8 September, and the case quickly became the subject of class action lawsuits.

Investigators have not publicly linked all of these incidents to a single group, and it would be wrong to assume they are connected. What they share is the method. Again and again, the disclosures describe social engineering, a compromised user or a false identity. None of them describes a sophisticated technical exploit.

Who Is Silent Ransom Group?

Silent Ransom Group (SRG), also tracked as Luna Moth and Chatty Spider, is a cyber extortion group that has been active since at least 2022. According to the FBI, law firms are its main target, although it has also attacked organisations in insurance, finance and healthcare.

What makes SRG unusual is what it doesn't do. It rarely uses custom malware. In many cases it doesn't deploy ransomware to encrypt anything. Instead, it:

1. Tricks an employee into granting access.
2. Uses legitimate remote access and system management tools to move around.
3. Quietly copies sensitive data out.
4. Demands payment in exchange for not publishing it.

Because the tools involved are legitimate, this activity can look like normal IT work. That is exactly why it is so hard to detect.

The FBI first warned US law firms about SRG in 2025. In May 2026, it issued an updated warning after the group started turning up in person. Attackers posing as IT staff visited offices, claimed they needed to back up or image a machine because of a "phishing issue", and plugged storage devices directly into computers.

How a Silent Ransom Group Attack Works

Understanding the playbook is the first step in defending against it. A typical SRG attack follows a pattern like this.

1. The Lure

Early campaigns used callback phishing. Employees received an email about an unexpected subscription renewal or invoice, with a phone number to call to cancel it. The email usually contained no malicious link or attachment, so it often passed through email security filters.

2. The Call

More recently, the group has moved to vishing (voice phishing). The attacker calls an employee directly and pretends to be the firm's IT help desk. They may mention a security alert, a mailbox problem or an urgent update. The caller sounds calm, professional and plausible.

3. The Access

The employee is persuaded to start a remote support session or install a legitimate remote access tool. From that point, the attacker is effectively sitting at the employee's desk, with the same access to documents, email and file shares.

4. The Exfiltration

Using ordinary file transfer tools, the attacker copies data out of the environment as quickly as possible. In a law firm, that might mean client files, litigation documents, M&A materials, HR records or personal data such as national insurance and Social Security numbers.

5. The Extortion

The firm receives a ransom demand. If it doesn't pay, the group lists the victim on its leak site and threatens to publish. The FBI has also reported that SRG contacts victims' employees and clients directly to increase the pressure.

6. The In-Person Variant

In the newest version of the attack, the "IT engineer" simply walks into the office. With a lanyard, a laptop bag and a confident manner, a stranger can get surprisingly far in a busy reception area.

Why Law Firms Are Such Attractive Targets

Cyber criminals go where the value is, and law firms offer a rare combination of advantages:

• Concentrated, high-value data. A single firm may hold confidential information for hundreds of corporate clients, including deal terms, litigation strategy, intellectual property and personal data.
• Confidentiality is the business model. A threat to publish privileged client material is especially damaging, which the attackers hope will make firms more likely to pay.
• Time pressure and hierarchy. Fee earners are busy, and junior staff may be reluctant to challenge someone who claims to be acting urgently for IT.
• Distributed working. Hybrid working, multiple offices and outsourced IT support make it harder for staff to know who their real IT contacts are.
• Supply chain value. A law firm breach can expose data belonging to clients who have invested heavily in their own security.

The UK's National Cyber Security Centre has long identified the legal sector as a priority target for exactly these reasons.

From Breach to Lawsuit in Weeks

The biggest change in 2026 is how quickly the consequences follow. A few years ago, a data breach at a law firm might have led to notification letters and some reputational embarrassment. Today:

• Plaintiff firms advertise investigations within days of a regulatory filing.
• Proposed class actions follow within weeks, typically alleging negligence in protecting personal data.
• Initial statements are closely examined. If a firm first describes an incident as involving "a limited number of documents" and later disclosures tell a fuller story, that gap can become part of the legal argument.
• Corporate clients send pointed security questionnaires and, in some cases, review their panel relationships.

For senior leadership, a cyber incident is now a legal, commercial and reputational risk, not just an IT problem.

What This Means for UK Law Firms

Most of the incidents above involve US firms and US courts, but UK firms should not take comfort from that. Several of the affected firms have major UK operations, and social engineering works the same way in London as it does in New York.

UK firms also face their own obligations:

• UK GDPR requires notifiable personal data breaches to be reported to the Information Commissioner's Office within 72 hours of becoming aware of them.
• The Solicitors Regulation Authority expects firms to protect client confidentiality and to report serious breaches promptly.
• Clients, particularly in financial services, are increasingly subject to operational resilience and third-party risk rules. They expect their outside counsel to meet a similar standard.

Collective actions over data breaches are also becoming more common in the UK. The legal exposure after an incident is growing on both sides of the Atlantic.

How to Protect Your Firm: A Practical Checklist

The good news is that the controls that stop Silent Ransom Group are well understood and achievable. Here is where we recommend law firms focus first.

Lock Down Your Help Desk

• Require strong identity checks before any password reset, MFA change or remote session.
• Use call-backs to a number already on file, never a number the caller provides.
• Make it clear that IT will never cold-call staff and ask them to install software.

Control Remote Access Tools

• Maintain an approved list of remote support tools and block everything else.
• Alert on any new remote access software being installed or run.
• Restrict who can install software at all.

Strengthen Authentication

• Enforce multi-factor authentication everywhere, prioritising phishing-resistant methods such as FIDO2 security keys or passkeys.
• Review conditional access policies for unusual locations and devices.

Detect Data Leaving the Network

• Deploy data loss prevention (DLP) controls on email, cloud storage and endpoints.
• Monitor for large or unusual file transfers, especially outside working hours.
• Make sure someone is watching alerts around the clock. Attackers don't keep office hours, and a 24/7 managed detection and response (MDR) service closes that gap.

Secure the Physical Office

• Brief reception and facilities teams on the in-person variant of these attacks.
• Require visitor sign-in and escorts for anyone claiming to be IT, even if they seem to know names and systems.
• Restrict or disable USB storage on endpoints where possible.

Train Your People, Then Test Them

• Run short, regular awareness sessions focused on vishing and callback phishing, not just email.
• Test your defences with realistic social engineering and penetration testing exercises.
• Celebrate staff who challenge suspicious requests. Challenging someone should feel normal, not awkward.

Prepare for the Worst

• Keep an incident response plan that includes legal, communications and regulatory reporting, not just technical recovery.
• Agree in advance who approves public statements, so early messaging is accurate.
• Rehearse the plan with a tabletop exercise based on a data extortion scenario.
  

Frequently Asked Questions

What Is Silent Ransom Group?

Silent Ransom Group, also known as Luna Moth, is a cyber extortion group active since at least 2022. It mainly targets law firms and uses social engineering, such as fake IT support calls, to gain access, steal data and demand payment.

Why Are Law Firms Targeted by Cyber Criminals?

Law firms hold large amounts of confidential client data, and their reputation depends on keeping it private. That makes them valuable targets for extortion.

What Is Callback Phishing?

Callback phishing is an attack in which an email persuades the recipient to phone a number controlled by the attacker, usually about a fake invoice or subscription. The attacker then talks the victim into granting remote access.

What Is Vishing?

Vishing, or voice phishing, is social engineering carried out over the phone. Attackers often pose as IT support, a bank or a supplier to trick people into sharing information or granting access.

How Can a Law Firm Tell If It Has Been Targeted?

Warning signs include unexpected calls from "IT", unfamiliar remote access software on devices, unusual login activity and large data transfers. Continuous monitoring by a security operations team is the most reliable way to spot these early.

Does Cyber Insurance Cover Data Extortion?

Coverage varies widely between policies. Firms should review their policy wording with their broker, particularly the exclusions and incident response requirements.

Summary

Cybergen helps organisations stay ahead of threats like Silent Ransom Group with a joined-up approach to prevention, detection and governance:

• CREST-certified penetration testing and threat intelligence to find weaknesses before attackers do.
• 24x7x365 managed detection and response to spot suspicious remote access and data exfiltration in real time.
• Email security and data loss prevention to cut off common lures and stop sensitive data leaving your firm.
• Incident response support when the worst happens.
• Governance, risk and compliance services, including ISO 27001, Cyber Essentials Plus and UK GDPR, to show clients and regulators that your security holds up.

The attackers targeting law firms today are not breaking in. They are being let in. Contact Cybergen to find out how exposed your firm is to social engineering and what to fix first. 

Ready to strengthen your security posture? Contact us today for more information on protecting your business.