Silent Ransom Group Extorts $207M From Law Firms Using Social Engineering
A cybercriminal group allegedly extracted $207 million from 27 law firms in six months by using phone calls and social engineering tactics instead of file encryption.
Key points
- Silent Ransom Group allegedly extorted $207 million from 27 law firms.
- The group used phone calls and social engineering rather than malware or encryption.
- The campaign targeted law firms exclusively over a six-month period.
The Silent Ransom Group allegedly extorted $207 million from 27 law firms in a six-month campaign, according to a report by Security Affairs. This operation relied entirely on phone calls and social engineering tactics rather than deploying malware or encrypting victim files. The group’s approach bypassed traditional technical defenses by targeting human vulnerabilities directly.
Security Affairs reported that the Silent Ransom Group did not use any malware payload or file-locking mechanisms during these attacks. Instead, the criminals contacted victims via phone and used social engineering to compel payments. This method proved highly effective, allowing the group to extract significant sums without triggering standard endpoint detection alerts associated with ransomware encryption.
Operational Tactics and Financial Impact
The financial scale of this campaign is substantial, with total extorted funds reaching $207 million. Security Affairs noted that the group targeted 27 distinct law firms during the six-month window. The consistency of the target sector suggests a specialized approach to exploiting legal industry workflows and sensitivities. The lack of technical malware means traditional security tools may have missed the initial intrusion vectors.
The success of this campaign highlights the effectiveness of non-technical attack vectors. By avoiding encryption, the Silent Ransom Group eliminated the forensic evidence typically left by ransomware. Victims likely faced pressure through social engineering calls rather than ransom notes on locked screens. This distinction changes the threat landscape for organizations relying heavily on automated security monitoring.
Targeting of Legal Sector Organizations
Law firms were the exclusive targets of this alleged extortion campaign. Security Affairs stated that all 27 victims operated within the legal sector. This focus may exploit the high value of client data and the reputational risks law firms face regarding confidentiality. The group’s strategy appears tailored to the specific operational pressures and communication norms of legal practices.
The concentration on law firms indicates a deliberate selection process by the attackers. These organizations often handle sensitive documents and face strict deadlines, making them susceptible to urgent social engineering demands. The six-month timeline suggests a sustained effort to identify and compromise multiple firms within this niche. The uniformity of the target type simplifies the attacker’s social engineering scripts and pressure tactics.
What should you do?
Organizations should review their incident response plans to include social engineering scenarios that do not involve malware. Legal firms and other high-value targets must ensure staff are trained to verify urgent payment requests through secondary channels. Monitoring for unusual communication patterns can help identify early signs of coercion attempts.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Silent Ransom Group
- Implement strict verification protocols for any urgent financial requests received via phone or email.
- Train employees to recognize social engineering tactics that bypass technical security controls.
- Monitor communication logs for unusual patterns that may indicate ongoing extortion attempts.
- Review access controls to ensure no single individual can authorize large payments without oversight.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Silent Ransom Group use malware in their attacks?
No, Security Affairs reported that the group did not use any malware payload or file encryption, relying solely on phone calls and social engineering.
How much money was allegedly extorted in this campaign?
The Silent Ransom Group allegedly extorted $207 million from its victims over the six-month period.
Which industry was targeted by this group?
The campaign targeted law firms exclusively, with 27 law firms identified as victims according to Security Affairs.
