FBI Warns About Silent Ransom Group Targeting Law Firms

The FBI issued a warning about the cybercriminal group Silent Ransom Group (SRG) and its recent social engineering calls and callback phishing emails targeting law firms in the United States. The government agency noted that while the group has historically targeted multiple industries, it has consistently focused on legal services since the spring of 2023.

According to the FBI’s notification published last Friday, SRG — also known as Luna Moth, UNC3753, and Chatty Spider — has been developing callback phishing email schemes for years, at least since 2022. These schemes traditionally involve offering fake subscription plans while impersonating well-known subscription-based businesses. However, Luna Moth’s tactics have recently evolved to include a more information technology (IT)-oriented approach.

“As of March 2025, SRG was observed changing their tactics to calling individuals and posing as an employee from their company’s IT department,” states the document. “SRG will then direct the employee to join a remote access session, either through an email sent to them or by navigating to a web page. Once the employee grants access to their device, they are told that work needs to be done overnight.”

When the criminal group gains access to the victim’s device, they begin exfiltrating data using multiple methods. The FBI noted that SRG may use Windows Secure Copy (WinSC) or a renamed version of Rclone, a command-line tool to migrate content to up to 70 cloud storage providers.

After gaining access to the victim’s data, they send a ransom email or call employees directly to negotiate payment. The tools and techniques they apply are difficult for antivirus products and users to detect.

The FBI shared several recommendations, including remaining alert to unauthorized downloads of remote access tools or system management, Rclone, or WinSCP linking to an external IP address, or emails claiming data has been stolen.

The agency also advised law firms to conduct employee training on these attacks, implement two-factor authentication for all workers, and maintain regular data backups.

A few months ago, the FBI also warned about cybercriminals exploiting law enforcement email accounts to send fake “emergency data requests” (EDRs).