Silent Ransom Group
An extortion group that contacts staff pretending to be IT support, gets remote access or sends someone in person, then steals data and threatens to publish it. It doesn't need to encrypt anything. Law firms are its main target.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters to UK Organisations
Silent Ransom Group goes after the sensitive data a firm holds, not its ability to operate. The FBI says it wants fast access, immediate data theft and extortion, with no traditional ransomware encryption.1 That means good backups, while still necessary, won't solve the problem. The threat is publication.
The pressure doesn't stop at the victim's front door. The FBI reports that the group calls employees and clients to push victims into negotiating, and posts stolen data on a public leak site.1 For a law firm or any professional adviser, that turns a security incident into a direct conversation with clients.
It is also hard to spot. The group relies on legitimate remote access tools, leaves few artefacts and is unlikely to trigger traditional antivirus.2,1
FBI reporting focuses on US law firms and names no UK victims.1 We wouldn't read that as UK firms being out of scope. The method needs a phone number and a believable story, and UK firms handling international work hold exactly the kind of data this group wants.
How It Attacks
Based on the FBI's May 2026 warning, which describes the group's method as of spring 2026.1
- 1
Make Contact
Calls the employee directly, or sends a phishing email urging them to call. Poses as internal IT support. Older campaigns used fake subscription charges.
- 2
Open a Remote Session
Talks the employee into granting a remote desktop session using a legitimate tool.
- 3
Turn Up in Person
If remote access fails, sends someone to the office, who inserts a storage device and claims it is needed for imaging or backup.
- 4
Escalate Only as Needed
Keeps privilege escalation to a minimum, which leaves less to detect.
- 5
Take the Data
Moves data out over the network, to cloud storage or to a physical drive, without encrypting the victim's systems.
- 6
Apply the Pressure
Sends a ransom email, calls employees and clients, and posts stolen data on its public leak site.
Key Techniques
ATT&CK v20 has no group entry for Silent Ransom Group. This mapping comes from the FBI's May 2026 warning.1
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1566 | Phishing | Initial Access | Callback emails using invoice, billing, subscription or IT lures. |
| T1598.004 | Voice Phishing | Social Engineering | Victims are told to call, or the actor impersonates IT. |
| T1219 | Remote Access Software | Execution | Legitimate remote tools used for interactive access. |
| T1078 | Valid Accounts | Credential Access | Possible use of victim credentials for email or cloud access. |
| T1560 | Archive Collected Data | Collection | Data may be staged or compressed. |
| T1530 | Data from Cloud Storage | Collection | Theft from Microsoft 365, OneDrive and Google Drive. |
| T1567 | Exfiltration Over Web Service | Exfiltration | Uploads to cloud or web platforms. |
| T1052.001 | Exfiltration to Removable Media | Exfiltration | In-person theft using a USB or external drive. |
| T1657 | Financial Theft / Extortion | Impact | Threatens to publish or sell the data. |
Tools Observed
Remote Access and Management
Data Theft
Destinations
Tool list from the FBI, which cautions that these legitimate tools should not be attributed to the group without evidence that the actor controlled them.1
Vulnerabilities
The FBI's warnings name no CVEs.2,1 This group gets in by persuading people, so a fully patched firm can still be a victim.
Use the Threat Watch feed for exploited vulnerabilities generally, but put your effort for this group into people, process and data access.
Key Events
Active from at least this year.1
Starts consistently targeting US law firms.1
Observed calling individuals while posing as their IT department, then sending someone in person with a storage device.2
The FBI issues a private industry notification to law firms.2
The FBI issues a further warning, describing IT impersonation and the in-person fallback as of spring 2026, and naming insurance, finance and healthcare victims.1
Warning Signs
From the FBI's indicator list.1 Filenames and IP addresses can change quickly, so assess these against what is normal in your environment.
- New, unauthorised downloads of remote access or system management tools
- Unauthorised USB or external drives connected to company computers
- WinSCP or Rclone connections to external IP addresses
- Data moving to OneDrive, Google Drive or unknown external servers
- Unidentified people claiming to be IT support and trying to access computers
- Unsolicited calls to staff from people claiming to work in IT
- Emails, calls or voicemails from an unnamed group claiming to have stolen data
- Clients being contacted and told their data was stolen
Defences That Matter
Make IT Support Verifiable
- Set and communicate how IT will contact and authenticate itself to staff.1
- Give staff a simple way to verify a caller and report a suspicious one.
- Train staff to identify, resist and report phishing.1
Check People in the Building
- Verify the identity of everyone accessing company spaces, including copying visitor ID.1
- Make it normal to challenge an unexpected IT visitor.
- Confirm any on-site IT visit with your IT team first.
Reduce What They Can Do
- Disable remote access tools and external drive installation on computers handling sensitive data, where possible.1
- Require phishing-resistant MFA and block port 22 where feasible.1
- Limit access to sensitive data from less secure networks.1
Prepare for Extortion
- Monitor for unusual tool use and large data transfers.
- Plan how you would tell clients quickly and accurately if they are contacted.
- Keep regular backups, but don't rely on them to answer a data theft threat.1
Would Your Staff Challenge a Fake IT Call?
We can test how your people and controls respond to the methods in this profile, and then help you close the gaps.
Sources
- FBI FLASH-20260526-01: Silent Ransom Group Impersonating IT Personnel through Social Engineering, 26 May 2026
- FBI PIN 20250523-001: Silent Ransom Group Targeting Law Firms, 23 May 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.