Loading story…
The Silent Ransom Group (SRG) reportedly targeted the law firms Hogan Lovells and Cadwalader, Wickersham & Taft in multiple attacks. Reporting alleges that SRG conducted follow-on attacks after the firms declined to pay extortion demands.
No technical details have been disclosed on the initial access vector, ransomware payload, scope of compromise, data allegedly taken, or operational impact. The firms’ responses and the attribution have not been independently confirmed in the available reporting.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Cadwalader, Wickersham & Taft merged with Hogan Lovells.
Silent Ransom Group allegedly conducted multiple attacks against Hogan Lovells and Cadwalader, Wickersham & Taft, including a re-attack after the firms allegedly declined to pay. The reporting provides no attack dates, intrusion details, or information on data theft or encryption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Silent Ransom Group (SRG) has reportedly listed international law firm **Greenberg Traurig** on its leak site, claiming to have stolen and published data from the firm. Reports indicate that roughly **126,000 individuals** may be affected, although the nature of the exposed records and the scope of the alleged intrusion have not been independently confirmed. Greenberg Traurig was reportedly among 64 law firms named on SRG’s leak site as of August 21, underscoring the group’s apparent focus on the legal sector. The incident raises questions over which organization is responsible for notifying affected people where the compromised information may belong to the firm’s clients or other third parties; it follows reporting on another legal-sector breach involving Troutman Pepper Locke.
Sep 14, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
Ransomware operators have expanded **double-extortion** tactics by targeting people around a victim organization, including senior executives, employees, customers, and business partners, to force ransom payments. Reporting tied the approach primarily to the **Clop** ecosystem, with similar behavior also attributed to **REvil** affiliates. Attackers were described as prioritizing executive mailboxes and workstations to find sensitive files, litigation records, and internal discussions that could be used to embarrass leadership or strengthen negotiations. The pressure campaign also extended beyond the company itself, with gangs emailing victims’ customers and associates to amplify reputational and legal risk. One cited case involved **RaceTrac Petroleum**, where data stolen via exploitation of a zero-day in **Accellion File Transfer Appliance** services used by a third party included some customer contact details, though the company said its corporate network and payment systems were not affected. Similar outreach was reportedly used against people linked to the **University of California**, underscoring how ransomware groups increasingly use public exposure and direct contact with stakeholders as leverage even when stolen data may later be leaked regardless of payment.
Aug 15, 2026