Most cyber attacks are carried out from a distance: a phishing email, a stolen password, a weakness quietly exploited from the other side of the world. Silent Ransom Group does things differently. When the online approach doesn’t work, they send someone to your office.
It’s as brazen as it sounds, and it’s working in the US. I don’t think it will be long before we see it here in New Zealand.
Who are Silent Ransom Group?
Silent Ransom Group (SRG) is a Russian-speaking cybercrime operation thought to have emerged in 2022 out of Conti, one of the most notorious ransomware gangs ever. Conti fell apart that year after a Ukrainian man leaked thousands of its internal chat logs in response to Russia’s invasion of Ukraine. The leaks also showed links between Conti’s operators and Russian intelligence.
The FBI and private researchers believe several former Conti members regrouped as Silent Ransom Group. It also goes by Luna Moth, Chatty Spider and UNC3753.
Unlike traditional ransomware gangs, they don’t encrypt your systems and sell you the key. They steal sensitive data and threaten to publish it unless you pay. Pure data extortion. No complicated encryption software needed, and it has proven very profitable.
The numbers
According to a cyber security executive who has helped arrange ransom payments to the group, it has extorted an estimated $100 million from law firms in the last six months alone. Other sources say tens of millions at the very least.
Law firms are their favourite target. They hold sensitive client information like corporate deals, litigation strategy and personal financial records. Having that exposed causes legal privilege headaches and serious reputational damage, which makes firms more likely to pay, and quickly.
Halcyon tracked 134 ransomware incidents against law firms in the first quarter of 2026, making legal services the fourth most targeted industry with more than 6% of all ransomware attacks in that period. Silent Ransom Group is a big part of that.
How the attacks work
Step one: the phone call. Staff get a call or phishing email from someone pretending to be IT support, warning about a virus or system problem that needs fixing urgently. They’re pushed to allow remote access to their computer.
Step two: if that fails, send someone in. If remote access is blocked, say by MDR/EDR security software or a careful employee, they escalate. A hired operative turns up at the office posing as an IT technician and tries to plug a USB drive straight into the target’s computer, getting around the defences they couldn’t beat remotely.
The group reportedly pays these people $500 a visit through a private Telegram channel. Researchers think many are gig workers who may not fully realise they’re committing a crime.
What it looks like in real life
A law firm in New Jersey got a call from “IT support” warning of a spreading virus. The next day a visitor arrived at reception asking to see the lawyer whose computer needed fixing. The lawyer smelled a rat (why would internal IT check in at reception?), and when he walked out to the front desk, the visitor turned and ran.
In another case, a man posing as IT support walked into a law firm wearing smart glasses, probably streaming live video back to the group. Before he got to the target’s desk, an accomplice rang the lawyer’s mobile pretending to be a FedEx dispatcher to get them away from their computer. He plugged in a USB drive, but the firm’s defences stopped the attack.
The group has even sent extortion letters by post, with return addresses traced to empty offices in Washington DC and Boston.
Why law firms?
Law firms hold confidential information on many clients at once, so one breach gives leverage over lots of people. And their duty to protect client privilege puts huge pressure on them to keep any leak quiet.
Cynthia Kaiser of Halcyon’s Ransomware Research Center says Silent was the first group to really focus on law firms, including major ones, and that the theft of data itself is the biggest problem for those firms. The FBI told CNN that Silent Ransom Group is the only data extortion group it knows of that physically visits victims’ premises, with “numerous physical access attempts” in US cities including New York and Washington DC.
Where things are now
The FBI is building a case, tracing ransom payments on the blockchain and gathering CCTV footage left behind by the hired operatives. One alleged former Conti member pleaded guilty in a US court this month. Whether leaving a physical trail (camera footage, reception logs, posted letters) is confidence or recklessness, the attacks are still happening.
What it means for NZ businesses
Right now they’re focused on US law firms. But blending phone and email social engineering with someone physically walking in isn’t limited by geography, and other groups will be watching. If your business handles sensitive client information, think about these:
- Social engineering is your biggest gap. The best technical defences in the world won’t help if someone lets a stranger walk in and plug something in. Make sure your security training covers physical scenarios, not just phishing emails.
- Verify before you trust. A phone call from “IT support” is not enough to give anyone remote or physical access. Have a clear process for checking who someone is before any support session.
- Governance matters. Businesses with a clear incident response plan, known escalation paths and regular security reviews are much more likely to spot this before it works.
The line between online and physical threats is blurring faster than most security plans have kept up with.
Would your team know what to do if “IT support” turned up at reception? Book a free health check, or call us on 0800 688 768.