Law firms across the United States are facing an intensifying wave of cyber attacks orchestrated by a persistent data extortion operation. Security researchers and federal authorities report that these operations rely heavily on sophisticated social engineering and, unusually, physical visits to target offices.

The Rise of Silent Ransom Group

The cybercriminal collective behind the surge is known as Silent Ransom Group, an operation that emerged in 2022 following the disbanding of Conti and is believed to operate from Russia. Also tracked by researchers under names including Chatty Spider, UNC3753, and Storm-0252, the group has claimed responsibility for more than over 100 attacks.

Activity has surged noticeably over recent months, prompting the FBI to issue a formal alert warning organizations about the threat. This follows an earlier warning released exactly one year prior regarding the group's consistent targeting of the legal sector since mid-2023.

Unique Tactics: Fake IT Support and In-Person Visits

Unlike many traditional ransomware operations that focus on encrypting systems, Silent Ransom Group specializes purely in data extortion without deploying encryption. Their methods blend digital trickery with real-world coordination:

  • Social Engineering: Attackers initiate contact using phishing emails or phone calls, tricking employees into reaching out to fake IT support operators.
  • Remote Access Attempts: If initial digital attempts to access a workstation fail, the group escalates the operation.
  • Physical Intrusions: In extraordinary tactics with virtually no parallel in the cybercrime ecosystem, the group has dispatched associates to visit victim locations in person and physically attach storage devices to workstations.

Researchers speculate that the group relies on gig workers or subcontractors—potentially operating as unwitting accomplices—to handle voice-based phishing calls in a common language and execute physical office visits.

Why Law Firms Are Prime Targets

Data compiled by Halcyon highlights the heavy toll on the legal sector, tracking 134 ransomware and extortion incidents against law firms and legal services during the first quarter of the year. This made the industry the fourth-most targeted, accounting for more than 6% of all recorded incidents, driven largely by Silent Ransom Group and another operation called Inc.

Experts note that law firms make lucrative targets because data theft creates immediate privilege and reputational crises. Because the exposure of sensitive client files carries severe consequences, extortionists bank on the perception that legal organizations may be more inclined to pay high demands to prevent data leaks.

Security analysts emphasize that defending against these operations is difficult because workplace environments inherently rely on trust and cooperation. Threat actors continue to exploit these human dependencies, demonstrating a willingness to invest extra effort into specialized sectors that other criminal groups typically bypass.