Loading story…
Silent Ransom Group (SRG) has reportedly listed international law firm Greenberg Traurig on its leak site, claiming to have stolen and published data from the firm. Reports indicate that roughly 126,000 individuals may be affected, although the nature of the exposed records and the scope of the alleged intrusion have not been independently confirmed.
Greenberg Traurig was reportedly among 64 law firms named on SRG’s leak site as of August 21, underscoring the group’s apparent focus on the legal sector. The incident raises questions over which organization is responsible for notifying affected people where the compromised information may belong to the firm’s clients or other third parties; it follows reporting on another legal-sector breach involving Troutman Pepper Locke.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
DataBreaches reported that Troutman Pepper Locke had been affected by a data breach and associated the firm with Silent Ransom Group leak-site listings.
As of August 21, Silent Ransom Group's leak site reportedly contained 64 law-firm listings, including Greenberg Traurig and Troutman Pepper Locke.
Silent Ransom Group allegedly attacked international law firm Greenberg Traurig, added it to its leak site, and leaked associated data. The incident reportedly may affect approximately 126,000 people.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new ransomware collective known as Trinity of Chaos, comprising the notorious threat groups Lapsus$, Scattered Spider, and ShinyHunters, has launched a data leak site on the TOR network, showcasing sensitive data allegedly stolen from 39 major organizations. The group claims to specialize in high-value corporate data acquisition and strategic breach operations, targeting a wide range of sectors including automotive, financial, insurance, technology, telecommunications, and more. Among the high-profile victims named are Google, Cisco, Stellantis, Toyota, FedEx, Disney, Marriott, McDonald’s, Qantas, Pandora, and Air France. The collective has also taken responsibility for the alleged theft of one billion Salesforce records, highlighting the scale and ambition of their operations. The group first emerged in August 2025, coordinating their activities and marketing a new ransomware-as-a-service (RaaS) offering called “shinysp1d3r” via a Telegram channel, which was later banned. According to security researchers, Scattered Spider provided initial access to targets, while ShinyHunters managed data exfiltration and public dumps, with Lapsus$ members actively participating in the campaigns. The leak site has published data samples including contact information and order details from Dell customers, full names and addresses from Telstra customers, and personally identifiable information from Kuwait Airways passengers. Other telecommunications firms such as Verizon, True Corporation & dtac, and Lycamobile have also been listed as victims, raising concerns about the potential for identity theft and social engineering attacks. The exposure of such sensitive data across multiple industries significantly increases the risk of downstream attacks, including phishing, fraud, and targeted scams. Security researchers have warned that the scale of the leaks could have far-reaching consequences for both individuals and organizations, especially given the diversity of the affected sectors. The Trinity of Chaos collective has demonstrated a high level of coordination and technical sophistication, leveraging the strengths of its constituent groups to maximize impact. The group’s public-facing leak site serves both as a tool for extortion and as a marketing platform for their RaaS offering. The inclusion of data from major global brands underscores the group’s reach and the potential for widespread reputational and financial damage. The collective’s activities have prompted urgent calls for affected organizations to assess their exposure, notify impacted individuals, and strengthen their security postures. The emergence of Trinity of Chaos marks a significant escalation in the ransomware threat landscape, with the group’s collaborative model likely to inspire similar alliances among other threat actors. Security experts continue to monitor the situation closely, warning that the group’s ongoing campaigns could result in further high-profile breaches and data leaks.
Jun 29, 2026
Ingram Micro disclosed that a **July 2025 ransomware attack** resulted in the theft of files from internal repositories and a subsequent data breach affecting **~42,000 people** (reported as **42,521** in filings). The company said an unauthorized party accessed and exfiltrated certain files between **July 2–3, 2025**, and that it detected the incident on **July 3**, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification. The compromised data primarily involved **employee and job applicant records**, including names, contact details, dates of birth, and government-issued identification numbers such as **Social Security**, driver’s license, and passport numbers, as well as some **employment-related information** (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that **SafePay** claimed responsibility and alleged theft of **~3.5 TB** of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Jun 29, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026