---
title: Silent Ransom Group Now Sending Fake IT Staff to Physically Breach Law Firms
description: SRG targets US law firms with sophisticated scams, impersonating IT to gain access. FBI advises strict verification and training.
canonical_url: https://codekeeper.co/ticker/srg-targets-us-law-firms-with-it-impersonation
---

# Silent Ransom Group Now Sending Fake IT Staff to Physically Breach Law Firms

SRG targets US law firms with sophisticated scams, impersonating IT to gain access. FBI advises strict verification and training.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 31, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A cybercriminal group called Silent Ransom Group (SRG), also tracked as Luna Moth, has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. It has hit law firms since spring 2023, and insurance, finance and healthcare firms too, using callback scams to trick employees into granting remote desktop access. In a May 26 FLASH alert, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely. SRG then threatens to sell or post the stolen files, and calls the firm's own employees and clients to pressure it into paying. The FBI recommends verifying visitor credentials and taking copies of their ID, disabling external drive permissions, blocking port 22 where possible, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access. **Source:** [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/silent-ransom-group-it/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsrg-targets-us-law-firms-with-it-impersonation%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Phishing Scam Poses as Big Brands to Steal Google Credentials from Marketing Pros Aug 12, 2026](https://codekeeper.co/ticker/phishing-campaign-targets-marketers-via-brands)

[Malware Can Hijack Windows Hello Keys to Break Into Microsoft Cloud Accounts Aug 11, 2026](https://codekeeper.co/ticker/malware-abuses-windows-hello-for-entra-id-access)

[LiteLLM Supply Chain Attack Exposed 2,500+ Organizations Aug 13, 2026](https://codekeeper.co/ticker/supply-chain-attack-on-litellm-exposes-organizations)

[Microsoft Exchange SSRF Vulnerability Exposed — PoC Exploit Now Public Aug 12, 2026](https://codekeeper.co/ticker/ssrf-vulnerability-found-in-microsoft-exchange)