Key points
- The group allegedly extorted $207 million from 27 law firms over a six-month period.
- Attacks relied on phone calls and social engineering instead of malware or file encryption.
- Security Affairs reports that no malicious code or locked files were involved in the extortion.
Security Affairs reports that the Silent Ransom Group has allegedly extorted $207 million from 27 law firms in a six-month period. The threat actor achieved these results without deploying malware or encrypting victim files, relying instead on direct phone calls and social engineering tactics to compel payment from targeted organisations.
The operation demonstrates a shift away from traditional ransomware mechanics. According to Security Affairs, the group did not lock files or install malicious payloads on victim systems. Instead, attackers used telephone communications to pressure law firms into paying ransoms, a method that reportedly works with extraordinary effectiveness against this specific sector.
Context and background on the attack method
Traditional ransomware attacks typically involve encrypting data to hold it hostage until a ransom is paid. However, Security Affairs notes that the Silent Ransom Group operates differently by omitting the technical encryption step entirely. The group’s strategy focuses on psychological pressure and social engineering rather than technical exploitation of software vulnerabilities or system weaknesses.
This approach allows the attackers to bypass many technical defences designed to detect malware execution or data exfiltration. By using phone calls, the group interacts directly with staff members, potentially exploiting trust or urgency to secure payments. Security Affairs highlights that this non-technical method has been highly successful for the group over the last half-year.
Who is affected by this campaign
The primary targets of this extortion campaign are law firms. Security Affairs states that 27 law firms were affected by the Silent Ransom Group’s activities within the six-month window. The sector appears to be specifically chosen by the attackers, likely due to the sensitive nature of legal data and the high stakes involved in client confidentiality.
No other industries are mentioned in the report as being targeted by this specific campaign. The exclusivity of the targeting suggests that the group has tailored its social engineering scripts to exploit the operational pressures and compliance requirements typical of legal practices. This focused approach may increase the success rate of their extortion attempts.
Our take on the response
Security teams should recognise that traditional endpoint detection may not prevent this type of attack. Since no malware is deployed, technical signatures are ineffective. Organisations must treat phone-based social engineering as a critical threat vector. Training staff to verify unusual payment requests through secondary channels is essential to mitigating this risk.
Background: Data exfiltration
Data exfiltration is the unauthorised transfer of sensitive information from a protected system to an external destination. Attackers use this technique to steal intellectual property, financial records or personal data. You can reduce risk by monitoring outbound traffic, enforcing least privilege access and maintaining a clear view of where your data resides.
Read the full guide: Data Exfiltration: How Attackers Steal Information and How to Stop It
What to do and how to stay safe: Silent Ransom Group
- Implement strict verification protocols for any financial transfers requested via phone or email.
- Train staff to recognise social engineering tactics used in telephone extortion attempts.
- Monitor for unusual communication patterns that may indicate an ongoing social engineering campaign.
- Review internal policies regarding emergency payment authorisations to reduce exposure to coercion.
Step-by-step guide: Detect Online Tracking: Signs in Logs, Browsers and Network Traffic
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Silent Ransom Group use malware to extort the law firms?
No, Security Affairs reports that the group did not use malware or encrypt files, relying solely on phone calls and social engineering.
How much money was allegedly extorted from the victims?
The Silent Ransom Group allegedly extorted $207 million from the targeted law firms over a six-month period.
How many law firms were affected by this campaign?
According to Security Affairs, 27 law firms were affected by the extortion campaign in the last six months.