Silent Ransom Group Now Sending Fake IT Staff to Physically Breach Law Firms

SRG targets US law firms with sophisticated scams, impersonating IT to gain access. FBI advises strict verification and training.

By Content Team

May 31, 2026

ON THIS PAGE

A cybercriminal group called Silent Ransom Group (SRG), also tracked as Luna Moth, has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. It has hit law firms since spring 2023, and insurance, finance and healthcare firms too, using callback scams to trick employees into granting remote desktop access.

In a May 26 FLASH alert, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely.

SRG then threatens to sell or post the stolen files, and calls the firm's own employees and clients to pressure it into paying.

The FBI recommends verifying visitor credentials and taking copies of their ID, disabling external drive permissions, blocking port 22 where possible, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access.

Source: Infosecurity Magazine

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?