Ransomware Actors Show Up In Person to Steal Law Firm Data

FBI Warns of In-Person Ransomware Social Engineering Targeting Law Firms

The FBI has issued a warning that the Silent Ransom Group (SRG) — an extortion gang also known as Luna Moth — has escalated its tactics to include physical in-person social engineering against law firms. Threat actors are presenting themselves on-site at target organizations and manipulating staff into granting them access to servers, databases, and file systems containing sensitive legal and client data.

The development marks a significant escalation in ransomware group tactics, moving beyond the conventional remote attack surface into direct physical social engineering that most enterprise security programs are not designed to detect or prevent.

How the Attack Works

Remote Foundation

Silent Ransom Group's operations typically begin with remote reconnaissance and initial contact:

1. Phishing and vishing — attackers impersonate IT support, software vendors, or law firm partners to establish contact with staff
2. Callback phishing — fake invoices or subscription alerts prompt victims to call an attacker-controlled number, where they are socially engineered into installing remote access tools
3. Credential harvesting — stolen or purchased credentials provide initial insight into the target organization's systems and personnel structure

Physical Escalation

Once basic reconnaissance is complete, actors from Silent Ransom Group physically attend the target premises:

• Threat actors present as IT support contractors, software auditors, or vendor representatives
• Staff are manipulated into providing physical or logical access to servers and data systems
• Attackers exfiltrate data directly from internal systems, bypassing the need to establish a persistent remote foothold
• Law firm databases — containing case files, privileged communications, financial records, and client personally identifiable information — are the primary targets

Extortion

Stolen data is used to extort law firms under threat of public disclosure, with actors typically:

• Contacting firm management directly via email or phone with proof of data possession
• Threatening to notify clients, opposing parties in active litigation, or regulatory bodies
• Demanding cryptocurrency ransom payments without deploying traditional encrypting ransomware

Why Law Firms Are Targeted

Law firms represent a high-value target profile for extortion groups for several reasons:

The Silent Ransom Group Profile

Silent Ransom Group is a financially motivated extortion actor that has been active since at least 2022. Key characteristics:

• Data theft without encryption — SRG typically exfiltrates data and extorts victims directly rather than deploying ransomware to encrypt systems, simplifying their operation and reducing law enforcement traceability
• Legal and professional services focus — law firms, accounting firms, and healthcare providers are recurring targets
• Vishing and callback phishing expertise — the group has refined social engineering techniques across hundreds of campaigns
• No ransomware-as-a-service model — SRG operates independently rather than as a RaaS affiliate, retaining tighter operational security

Protective Measures

Physical Security Controls

1. Enforce strict visitor identification — require government-issued photo ID and pre-scheduled appointment confirmation from any person claiming to be an IT vendor or support contractor
2. Verify vendor visits independently — call the vendor's official number (not one provided by the visitor) to confirm the visit is legitimate before granting access
3. Escort all non-staff personnel in server rooms, network closets, and areas with unattended workstations
4. Train reception and administrative staff to recognize social engineering techniques — they are the first line of defense against in-person attacks

Technical Controls

1. Enforce multi-factor authentication on all internal systems and databases — even physical access to a workstation should not provide credential-free access to case management systems
2. Implement privileged access management (PAM) — restrict and log access to servers and databases containing sensitive data
3. Monitor for unusual bulk data access — data loss prevention (DLP) tools should alert on large volume reads or transfers from case management and document management systems
4. Audit access logs regularly — particularly for after-hours access or access from unfamiliar devices

Incident Response

• Law firms that suspect they have been targeted should contact the FBI's Internet Crime Complaint Center (IC3) at ic3.gov
• Preserve logs and do not power down affected systems before consulting with incident response professionals
• Notify professional liability insurers promptly as most cyber policies require timely notification

Industry Context

Physical social engineering attacks against organizations have historically been associated with targeted espionage operations, but the Silent Ransom Group's adoption of in-person tactics represents their migration into financially motivated cybercrime. The blurring of physical and cyber attack vectors — sometimes called hybrid attacks — is an emerging challenge for enterprise security programs designed primarily to defend network perimeters.

Law firms are encouraged to treat physical premises security as a component of their cybersecurity posture rather than a separate operational function.

Source: Dark Reading