Silent Ransom Group allegedly extorted law firms by using phone calls and social engineering to trick employees into giving access or uploading sensitive files, without encrypting data. Leaked internal chats suggest 27 law firms paid roughly $207M in a six‑month span, with individual payments reportedly reaching $30M. The reporting highlights simple but effective human-manipulation tactics (IT impersonation, credential theft, and file transfer to external cloud storage).
According to the reporting, Silent Ransom Group allegedly extorted law firms without ever deploying ransomware encryption. Instead, the group relied on phone calls and social engineering to gain access or convince employees to hand over sensitive data directly. Leaked internal chats, reportedly totaling 5,692 messages over about 13 months, allegedly document negotiations, access methods, and targeting plans.
Two named examples illustrate the approach. In one, an attacker posed as internal IT and convinced an attorney to upload case files to an external Google Drive, a tactic that required no malware at all. In another, an employee was reportedly tricked into providing login credentials to an unauthorized caller. Internal records claim about $207M was paid by 27 firms over a roughly six-month window, with a reported median payment of $6M.
The attacks did not rely on technical exploits. They worked because employees trusted a voice on the phone claiming to be internal IT or security. Framing the request as urgent and routine, such as moving files for review or confirming account access, reduced the chance that staff would pause and verify. Legal services staff handling sensitive case files and credentials were positioned as high-value targets because a single successful call could produce direct access to client data without needing to breach any network defenses.
Organizations, especially in legal services, should treat unexpected IT helpdesk calls as high risk and require verification through a known internal number before any action is taken. Staff should be trained to never share credentials over the phone, since legitimate IT and security teams should not ask for passwords this way. Case files and client documents should only be shared through approved firm tools, with any request to use external cloud storage escalated for review. Because this scheme generated significant profits without using malware or encrypting files, awareness training should emphasize unauthorized access and data leakage risks, not just malware or ransomware pop-up scenarios.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
No. According to the reporting, the group allegedly extorted victims without deploying ransomware encryption, relying instead on phone calls and social engineering.
Leaked internal records reportedly claim about $207M paid by 27 firms between April 3 and September 24, 2026, with a reported median payment of $6M.
Named examples describe an attacker impersonating internal IT to convince an attorney to upload files to an external Google Drive, and another case where an employee was tricked into providing credentials to an unauthorized party.
The targeting focused on legal services, with attorneys, legal assistants, IT helpdesk staff, and information security teams all identified as relevant audiences.
Silent Ransom Group pulled in about two hundred seven million dollars from law firms… mostly by phone calls, not malware. Picture this call: 'Hi, this is IT support, urgent issue. I need you to move a few case files to a secure external Google Drive so we can review them.' That exact script convinced an attorney to upload client files to someone’s personal Drive. Another favorite line: 'This is IT security, we’re fixing a sign‑in issue tied to your account. I need to confirm your login so we can restore access.' One employee at a major firm read out their username and password. No malware. Just a phone and trust. Here’s your move: if “IT” calls you out of the blue asking for files or passwords, hang up, look up the real helpdesk number in the directory, and call them back to verify before you do anything.
The article highlights real-world voice-phishing attacks where criminals impersonated employees to persuade help desks to reset passwords or approve Microsoft Entra authentication steps, effectively bypassing MFA. It cites major incidents affecting Las Vegas casinos (including MGM Resorts and…
Microsoft reports an active campaign where attackers pose as IT helpdesk staff and pressure employees to “update or enroll” passkeys, MFA, or SSO. Victims are pushed to either a fake Microsoft sign-in page (AiTM phishing) or a real Microsoft device-code flow, resulting in attackers gaining…
Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…
McKesson disclosed a breach tied to unauthorized access of third-party applications and data theft affecting some customers. The ShinyHunters extortion group claims it used phone-based social engineering (vishing) to steal employee credentials, took over Okta single sign-on accounts, and then…
ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker…
Uber Freight is investigating unauthorized access after the Helix extortion group claimed it stole nearly one million files from company cloud and email repositories. Google-linked research says the broader cluster (UNC6671) commonly gets in by calling employees and posing as IT helpdesk staff…
