Loading story…
The Silent Ransom Group — also tracked as UNC3753, Luna Moth, and Chatty Spider — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels.
Authorities said the campaign has escalated beyond remote access attempts to in-person intrusions, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including business-data-leaks[.]com and ep6pheij[.]com. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On 5 June 2026, Google Threat Intelligence Group published research on an ongoing campaign against U.S. law firms and assessed that attempted in-person data theft incidents likely overlapped with UNC3753 based on targeting, structure, and timing. The report also documented the group's use of remote monitoring tools, help-desk impersonation, and extortion-focused data theft.
Google Mandiant said UNC3753 targeted dozens of U.S. legal, financial, and professional services organizations between January and May 2026. The campaign relied on invoice-themed emails, vishing, screen sharing, and legitimate remote management tools to steal sensitive data and quickly extort victims.
On 26 May 2026, the FBI issued FLASH-20260526-01 warning that SRG was actively targeting U.S.-based law firms through phishing, fake IT support calls, and in some cases in-person access attempts. The alert detailed rapid data exfiltration and extortion activity and recommended stronger visitor verification, MFA, and restrictions on remote access and removable media.
Resecurity reported that it identified fast-flux infrastructure supporting SRG leak sites including business-data-leaks[.]com and ep6pheij[.]com. The report described rotating residential IPs, DNS changes, and tokenized links designed to make the actor's leak ecosystem more resilient to blocking and takedown.
A 23 May 2025 FBI and DHS/CISA private industry notification said that as of April 2025 SRG had shifted from callback phishing and remote-access abuse to phone impersonation of internal IT staff followed by sending someone onsite to insert a storage device and steal data. The notice warned that the group used legitimate tools and left few artifacts.
Google said the group changed tactics around March 2025, moving from earlier callback-phishing and billing-lure approaches toward impersonating internal IT help desk staff. This shift underpinned later vishing-led intrusions and remote management tool abuse.
Google Threat Intelligence Group described UNC3753, also known as Silent Ransom Group, Luna Moth, and Chatty Spider, as financially motivated and active since at least March 2022. Reporting also links the actor to the post-Conti ecosystem and a shift away from ransomware deployment toward pure data theft and extortion.
The FBI said SRG has consistently focused on U.S.-based law firms since spring 2023, while also targeting sectors such as finance, insurance, and healthcare. Multiple reports characterize the legal sector as a primary long-term focus because of the sensitivity of client and case data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
29 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourceoccrp.org
Open sourcecodeby.net
Open sourcebrightdefense.com
Open sourceresecurity.com
Open sourceic3.gov
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**BlackFile**, a financially motivated extortion group likely tied to **The Com** and overlapping with activity tracked by CrowdStrike as **Cordial Spider**, has targeted retail and hospitality organizations with voice-phishing campaigns that impersonate corporate IT help desks. Researchers at Palo Alto Networks Unit 42 and RH-ISAC said the group has been active since at least February 2026, using spoofed phone numbers and fake corporate single sign-on pages to trick employees into surrendering credentials and one-time passcodes. After gaining access, the attackers register their own devices to bypass MFA, escalate privileges into administrative and executive accounts, and steal data from platforms including **Salesforce** and **SharePoint** through legitimate API and download functions. The stolen information is moved to attacker-controlled infrastructure, posted on a dark web leak site, and used to support **seven-figure ransom demands** sent from compromised employee accounts or Gmail; in some cases, the group has also used **swatting** against employees and executives to intensify pressure on victims.
Jun 29, 2026
Suspected former **Black Basta** affiliates have launched a fast-scaling social-engineering campaign against dozens of organizations, targeting more than 100 employees to gain network access for **data theft, ransomware deployment, and extortion**. According to ReliaQuest, the operators use mass email bombing to overwhelm victims and then follow up through **Microsoft Teams** messages or phone calls while impersonating IT help desk staff. The activity has been linked to former Black Basta members or closely aligned actors because the tooling, targeting, and execution closely mirror the group’s historical playbook, even after Black Basta fragmented following the leak of its internal chats. The campaign has increasingly focused on senior leaders and other highly privileged personnel, with executive targeting rising from **59%** in January and February to **77%** in March. Attackers have persuaded victims to install remote monitoring and management tools such as **Supremo Remote Desktop** or to launch **Windows Quick Assist**, sometimes obtaining remote access within minutes before running malicious scripts. Manufacturing and professional services have been hit hardest, with finance, insurance, construction, and technology also affected, underscoring how the operators are moving faster and using more automation to scale intrusions and make early detection more difficult.
Jun 29, 2026
CrowdStrike reported that two financially motivated threat groups tied to **The Com** — **Cordial Spider** and **Snarky Spider** — are carrying out rapid data-theft and extortion campaigns against U.S.-based organizations across critical infrastructure and enterprise sectors, including aviation, retail, hospitality, financial services, legal, technology, automotive, and academia. The actors are closely aligned with the **Scattered Spider** playbook and have used voice phishing, text messages, email, and other social-engineering tactics since at least October 2025 to compromise identity platforms, steal credentials, session keys, and tokens, and pivot through victims’ SaaS environments. Ransom demands have reportedly reached seven figures, and some victims have also faced **DDoS** attacks or swatting. The intrusions rely on adversary-in-the-middle phishing pages that mimic legitimate single sign-on and identity-provider portals, enabling access to services such as **SharePoint**, **HubSpot**, and **Google Workspace** while largely bypassing traditional endpoint defenses. After gaining access, the attackers register their own MFA devices or emulators, disable or suppress alerts through inbox rules and email deletion, and move quickly to search for sensitive data and exfiltrate it, in some cases within an hour of initial access. Researchers said the groups differ in tradecraft — including operating hours, phishing infrastructure, leak sites, and MFA-registration methods — while both use commercial VPNs and residential proxy networks such as **Mullvad**, **Oxylabs**, **NetNut**, **9Proxy**, **Infatica**, and **NSOCKS** to blend into normal traffic and evade detection.
Jun 29, 2026