Extortion Gang Plots Office Infiltration of Law Firms

Leaked chat logs linked to the Silent Ransom Group describe efforts to pressure U.S. law firms through extortion and, unusually, by sending in-person “agents” to physically enter offices and copy data. The FBI previously warned that people tied to the group were posing as IT staff to gain access, and one law firm said someone entered its New York office and copied files to a flash drive.

Key findings

• Leaked chats describe tracking victims, negotiating multi-million-dollar extortion payments, and directing U.S.-based operatives called “agents.”
• Chainalysis said crypto addresses in the leak could be tied to known extortions by the Silent Ransom Group (also tracked as Luna Moth/Chatty Spider).
• The FBI warned the group used a physical-access tactic: “posing as IT personnel to gain physical access to computers.”
• A law firm negotiator said “an individual had entered its New York office and copied files onto a flash drive.”
• Chats proposed office-entry pretexts including a pizza delivery ruse and then switching to an IT-worker impersonation inside the office.
• The group reportedly recruited “agents” using paid Telegram job ads disguised as normal work (courier, nightclub promotion, security).

Who’s being targeted

• Commonly targeted roles: Reception/Front desk, Office administrators, Facilities/Security, IT/Helpdesk, Partners/Legal leadership, All employees (visitor challenge culture).
• Affected industries: Legal services (law firms), Defense / military contractors (discussed as potential targets).
• Attack channels: physical, telegram.
• Impersonated: Pizza delivery worker, then internal IT personnel, Unspecified on-site visitor (described as someone who entered the office), Job advertiser offering legitimate work (nightclub promotion/courier/security).

Awareness takeaways

• Treat unexpected on-site IT help or ‘urgent’ walk-ups as suspicious; verify identity via known internal channels before granting access.
• Harden front-desk and visitor controls (sign-in, badging, escorting) to prevent ‘social’ entry methods like delivery pretexts from reaching work areas.
• Limit and monitor removable media use (USB/flash drives) to reduce the risk of fast, on-site data theft.
• Be aware that criminals may recruit local ‘agents’ through seemingly normal online job ads; encourage reporting of suspicious recruiting approaches.

Red flags to watch for

• Unexpected visitor tries to move beyond reception into employee-only areas
• Visitor switches roles (delivery person becomes “IT”) once inside
• No pre-arranged ticket/appointment or verification with the firm’s IT team
• Unescorted visitor or unknown person near workstations/files
• Use of removable media (USB) on office computers
• Lack of sign-in/badging and no clear business reason for accessing files
• Vague job duties with unusually high pay and quick cash
• Pressure to keep details secret or incomplete explanation of the real purpose
• Paid “test assignments” that feel unrelated to the advertised job