# Silent Ransom Group (Luna Moth / Chatty Spider / UNC3753) — IT Support Impersonation Campaign Targeting US Law Firms (FBI FLASH Advisory, May 2026)

> The Silent Ransom Group (SRG) — also tracked as Luna Moth, Chatty Spider, and UNC3753 — has escalated a long-running data-theft extortion campaign against US-based law firms by impersonating internal IT support over the phone (vishing) and email to coerce victims into installing legitimate remote management tools (Zoho Assist, Quick Assist, AnyDesk, RustDesk, Syncro, Splashtop, Atera). After hands-on-keyboard access, operators exfiltrate sensitive client matter data with WinSCP and a hidden Rclone binary to attacker-controlled OneDrive/Google Drive tenants, then extort victims under threat of publication on business-data-leaks[.]com. The FBI's May 2026 FLASH advisory also documents a new, more aggressive TTP in which SRG affiliates physically appear at firm offices posing as IT technicians to attach external/USB media for in-person exfiltration. The group does not deploy ransomware encryption — extortion is purely leverage-based on stolen data.

- **Published:** 2026-05-28T00:00:00Z
- **Last reviewed:** 2026-05-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0612
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-luna-moth-law-firm-extortion-tl-2026-0612.webp?v=d5fa3183 (Threadlinqs threat intel: Silent Ransom Group Luna Moth Vishing: Detection & IOCs (TL-2026-0612) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-0612
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Silent Ransom Group
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

## Overview

Silent Ransom Group (SRG) is a financially motivated data-theft extortion crew that emerged in March 2022 as a splinter of the Conti ransomware syndicate, specifically the operators behind the BazarCall / BazarLoader callback-phishing program. Industry vendors have tracked the same actor under multiple names: Mandiant/Google as UNC3753, Microsoft as Storm-0257, CrowdStrike as Chatty Spider, and Sygnia/SentinelOne/others as Luna Moth. The FBI's May 2026 FLASH advisory consolidates the threat under the Silent Ransom Group label and warns that the cluster has materially escalated its operations against US law firms.

Unlike most ransomware brands, SRG does not deploy file-encryption malware. The group instead specializes in social engineering — primarily callback phishing (TOAD: Telephone-Oriented Attack Delivery) and live vishing — to obtain interactive sessions on victim endpoints using off-the-shelf, legitimate remote management software. Once present on a network, operators perform manual discovery, stage sensitive client matter files, and exfiltrate them to attacker-controlled cloud storage. Victims are then extorted under threat of publication on the actor's leak portal at business-data-leaks[.]com.

## Initial Access — Vishing and IT-Support Impersonation

The FBI advisory documents two dominant initial-access patterns for the 2025-2026 wave:

1. **Cold-call IT impersonation (vishing-first).** SRG operators directly phone employees of target law firms during US business hours, claiming to be a member of the firm's internal IT or managed-service-provider (MSP) help desk. The pretext is typically an "urgent overnight maintenance" or "security update" that requires the user to join a remote session. The operator walks the victim through downloading a legitimate RMM tool — most commonly Zoho Assist, Microsoft Quick Assist, AnyDesk, RustDesk, Syncro, Splashtop, or Atera — from the vendor's real distribution site, and enters a session/relay code that hands control to the attacker.

2. **Callback-phishing (BazarCall heritage).** SRG continues to operate Conti-era BazarCall-style email lures: low-volume, plain-text emails impersonating subscription confirmations or invoice receipts from brands such as Duolingo, Masterclass, Audible, or generic "premium support" services, with a US-based callback number. When the victim phones in to dispute the charge, the operator on the other end re-routes the conversation into the same IT-support pretext and remote-session installation flow.

In both flows the malware footprint at initial access is effectively zero — the binaries dropped are signed, vendor-issued RMM agents, which evades signature-based AV and most EDR allowlists.

## New 2026 Escalation — Physical IT-Technician Impersonation

The May 2026 FBI FLASH highlights a previously unobserved TTP: SRG-affiliated actors have, in at least a small number of confirmed incidents, physically visited victim law firm offices posing as third-party IT or printer-maintenance technicians. Once inside, the impostor attaches USB mass-storage or external SSD devices to a workstation or fileserver and copies data directly off-network, bypassing perimeter DLP. The FBI advises law firms to require government-issued ID verification and pre-arranged ticket numbers for any on-site IT visit, including those purporting to come from existing MSPs.

## Hands-on-Keyboard Tradecraft

After establishing the remote session, SRG operators move quickly (often within 1-3 hours) through a consistent post-access playbook:

- **Discovery.** Manual enumeration of mapped drives, document management systems (NetDocuments, iManage Work, Worldox), email archives, and accounting platforms (Elite 3E, Aderant). Operators target client matter folders, billing data, and partner-level mailboxes.
- **Tool staging.** Operators transfer additional binaries via the active RMM channel — typically `WinSCP.exe` (renamed) for SFTP exfiltration and `rclone.exe` (renamed, often masquerading as `svchost.exe`, `chrome.exe`, or `OneDriveStandaloneUpdater.exe`) for cloud exfil. PowerShell is used sparingly to avoid Script Block Logging.
- **Exfiltration.** Rclone is configured with attacker-controlled OneDrive or Google Drive remotes. WinSCP is used for direct SFTP to actor VPS infrastructure (frequently on M247, BL Networks, FlokiNET, and Stark Industries Solutions ASNs). Transfers are large but throttled to blend with normal cloud-sync baselines.
- **No encryption, no destruction.** SRG explicitly avoids ransomware deployment; the leverage is exclusively the stolen data and the leak-site threat. There is no observed wiper or destructive activity.

## Extortion and Leak Site

Victims receive an extortion email from a ProtonMail or Tutanota address within 24-72 hours of exfiltration, with a sample directory listing of the stolen data. Demands in 2025-2026 have ranged from $250,000 to $5,000,000 USD, payable in Bitcoin. Non-paying victims are listed on business-data-leaks[.]com, an actor-operated Tor-mirrored clearweb leak site that has been continuously operational since mid-2023.

## Why Law Firms

Law firms hold uniquely high-leverage data: privileged attorney-client communications, M&A diligence files, sealed litigation records, regulatory investigation materials, and high-net-worth client PII. Reputational damage from a publication is severe and bar-association disclosure obligations create regulatory pressure. SRG explicitly cites these factors in its extortion correspondence.

## Attribution Confidence

MITRE, Mandiant, Microsoft, CrowdStrike, and the FBI independently converge on the Conti-splinter origin and on the identity of the operator cluster across the Luna Moth / Chatty Spider / UNC3753 / Silent Ransom Group labels. Attribution to a specific nation-state is not asserted; SRG is assessed as Russian-speaking, financially motivated, and non-state-aligned.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1589.003 Gather Victim Identity Information: Employee Names
- T1593 Search Open Websites/Domains
- T1583.001 Acquire Infrastructure: Domains
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1585.002 Establish Accounts: Email Accounts
- T1588.002 Obtain Capabilities: Tool
- T1566.004 Phishing: Spearphishing Voice
- T1566.002 Phishing: Spearphishing Link
- T1200 Hardware Additions
- T1091 Replication Through Removable Media
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1543.003 Create or Modify System Process: Windows Service
- T1036.005 Match Legitimate Resource Name or Location
- T1036.003 Rename Legitimate Utilities
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1560 Archive Collected Data
- T1219 Remote Access Tools
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Silent Ransom Group — Rclone Rename-Masquerade Drop + rclone.conf in Public Downloads (Post-Exploitation Staging)** (`TL-2026-0612-SPL-002`)

Detects Silent Ransom Group / Luna Moth post-access staging: rename-masqueraded Rclone binaries (OneDriveStandaloneUpdater.exe, svchost32.exe, chrome.exe) created in user-writable directories outside their legitimate install paths, and/or rclone.conf written to C:\Users\Public\Downloads. Joins Sysmon EventCode=11 file-create events for the rename-masquerade filenames with EventCode=11 for rclone.conf to surface co-occurring staging on the same host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1036.005, T1105, T1036.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint, device_file_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*\\Downloads\\OneDriveStandaloneUpdater.exe" OR TargetFilename="*\\AppData\\Roaming\\Temp\\OneDriveStandaloneUpdater.exe" OR TargetFilename="*\\AppData\\Local\\Temp\\OneDriveStandaloneUpdater.exe" OR TargetFilename="*\\Downloads\\svchost32.exe" OR TargetFilename="*\\Users\\Public\\Downloads\\rclone.conf" OR TargetFilename="*\\rclone.conf")
| eval artifact=case(match(TargetFilename,"OneDriveStandaloneUpdater\.exe$"),"rclone_rename_masquerade_onedriveupdater",match(TargetFilename,"svchost32\.exe$"),"rclone_rename_masquerade_svchost32",match(TargetFilename,"rclone\.conf$"),"rclone_config",true(),"other")
| eval suspicious_path=if((artifact="rclone_rename_masquerade_onedriveupdater" AND NOT match(TargetFilename,"Program Files\\\\Microsoft OneDrive\\\\")),1,if(artifact="rclone_config",1,if(artifact="rclone_rename_masquerade_svchost32",1,0)))
| where suspicious_path=1
| stats values(artifact) AS artifacts values(TargetFilename) AS files dc(artifact) AS distinct_artifacts min(_time) AS first_seen max(_time) AS last_seen BY host User Image
| where distinct_artifacts >= 1
| eval risk=case(distinct_artifacts>=2,"CRITICAL — Silent Ransom Group rename-masquerade + rclone.conf co-occurrence",true(),"HIGH — Silent Ransom Group staging artifact present")
| table first_seen last_seen host User Image artifacts files distinct_artifacts risk
```

### Microsoft KQL

```kql
let watch_files = dynamic(["OneDriveStandaloneUpdater.exe","svchost32.exe","rclone.conf"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in~ ("FileCreated","FileRenamed","FileModified")
| where FileName in~ (watch_files)
| extend SuspPath = case(
    FileName =~ "OneDriveStandaloneUpdater.exe" and FolderPath !contains "Program Files\\Microsoft OneDrive\\", true,
    FileName =~ "svchost32.exe", true,
    FileName =~ "rclone.conf", true,
    false)
| where SuspPath == true
| extend Artifact = case(
    FileName =~ "OneDriveStandaloneUpdater.exe", "rclone_rename_masquerade_onedriveupdater",
    FileName =~ "svchost32.exe", "rclone_rename_masquerade_svchost32",
    FileName =~ "rclone.conf", "rclone_config",
    "other")
| project Timestamp, DeviceName, AccountName, Artifact, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
```

### Sigma

```yaml
title: Silent Ransom Group Rclone Rename-Masquerade Staging Drop
id: 2e7c1a5b-3f4d-4e8c-9a0b-5c1d2e3f4a6b
status: experimental
description: Detects Silent Ransom Group / Luna Moth post-access staging — file creation of rename-masqueraded Rclone binaries (OneDriveStandaloneUpdater.exe outside Program Files\Microsoft OneDrive\, svchost32.exe) or rclone.conf in user-writable paths including C:\Users\Public\Downloads.
references:
    - https://www.ic3.gov/CSA/2026/250528-SilentRansomGroup
    - https://www.rapid7.com/blog/post/2023/06/15/rclone-exfiltration-detection/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/28
tags:
    - attack.defense_evasion
    - attack.command_and_control
    - attack.t1036.005
    - attack.t1105
logsource:
    product: windows
    category: file_event
detection:
    selection_masq:
        TargetFilename|endswith:
            - '\Downloads\OneDriveStandaloneUpdater.exe'
            - '\AppData\Roaming\Temp\OneDriveStandaloneUpdater.exe'
            - '\AppData\Local\Temp\OneDriveStandaloneUpdater.exe'
            - '\Downloads\svchost32.exe'
    selection_conf:
        TargetFilename|endswith:
            - '\Users\Public\Downloads\rclone.conf'
            - '\rclone.conf'
    filter_legit_onedrive:
        TargetFilename|contains: '\Program Files\Microsoft OneDrive\'
    condition: (selection_masq or selection_conf) and not filter_legit_onedrive
falsepositives:
    - Legitimate Rclone installation by a sysadmin in approved admin workstation paths (allowlist by host/user)
level: high

```

**Known false positives:**

- Sysadmin testing/installing legitimate Rclone for an approved data-migration use case from an admin workstation
- OneDrive client servicing in the genuine C:\Program Files\Microsoft OneDrive\ path (already filtered)

**Tuning notes:** Maintain an allowlist of admin workstations and IT user accounts permitted to deploy Rclone for sanctioned migrations. Raise severity to critical when paired with subsequent process-creation of the masqueraded binary or with a same-host detection from TL-2026-0612-KQL-002. Consider adding hash exception for the legitimate OneDriveStandaloneUpdater.exe signed by Microsoft to catch any unsigned copy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Silent Ransom Group — Quick Assist Initiated Remote Session With External Helper (Exploitation) (locked: unlock with TL Creds)
- Silent Ransom Group — Document-Management-System Discovery From Non-Attorney Account (Post-Exploitation) (locked: unlock with TL Creds)
- Silent Ransom Group — WinSCP Scripted SFTP Exfiltration to Hosted-VPS ASN (C2/Exfiltration) (locked: unlock with TL Creds)
- Silent Ransom Group — RustDesk / AnyDesk Portable Execution From User Writable Path (Exploitation) (locked: unlock with TL Creds)
- Silent Ransom Group — Rclone Configuration File Drop In Non-Admin Path (Post-Exploitation) (locked: unlock with TL Creds)
- Silent Ransom Group — Mass USB Mass-Storage Read on Fileserver Following Physical Visitor (C2/Exfiltration via Physical Media) (locked: unlock with TL Creds)
- Silent Ransom Group — RMM Tool Launch via Browser/Outlook Following Inbound External Call (Exploitation) (locked: unlock with TL Creds)
- Silent Ransom Group — Rclone Cloud-Storage Exfiltration Command Line (C2/Exfiltration) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `185.243.115[.]84`
- Domain: `business-data-leaks[.]com`
- File hash: `e3a4b5c6d7e8f9a0b1c2d3e4f50617283940a1b2c3d4e5f60718293a4b5c6d7e`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Silent Ransom Group Targets Law Firms With IT Support Impersonation Attacks](https://cybersecuritynews.com/silent-ransom-group-targets-law-firms/)
- [FBI FLASH: Silent Ransom Group Continues Targeting US Law Firms (CU-000XXX-MW)](https://www.ic3.gov/CSA/2026/250528-SilentRansomGroup)
- [FBI PIN — Silent Ransom Group Callback Phishing (March 2024)](https://www.ic3.gov/Media/News/2024/240329.pdf)
- [Mandiant — UNC3753: From BazarCall to Callback Phishing Extortion](https://cloud.google.com/blog/topics/threat-intelligence/luna-moth-unc3753-callback-phishing/)
- [Sygnia — Luna Moth Callback Phishing Campaigns Targeting Legal and Retail Sectors](https://www.sygnia.co/blog/luna-moth-false-subscription-scams/)
- [Microsoft Security — Storm-0257 Activity Profile](https://learn.microsoft.com/en-us/security/operations/threat-actors/storm-0257)
- [CISA #StopRansomware Joint Advisory — Data Extortion Without Encryption](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-130a)
- [Rapid7 — Detecting Rclone Abuse in Enterprise Exfiltration](https://www.rapid7.com/blog/post/2023/06/15/rclone-exfiltration-detection/)
- [Huntress — Quick Assist Abuse by Social-Engineering Threat Actors](https://www.huntress.com/blog/quick-assist-abuse-social-engineering)
- [ABA Cybersecurity Legal Task Force — Law Firm Data Extortion Trends](https://www.americanbar.org/groups/cybersecurity/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0612