Threat reportRansomwareTL-2026-2103
Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical Intrusion)
Troutman Pepper Locke LLP Data Theft Extortion by (TL-2026-2103) is a high-severity ransomware operation, first published 2026-08-21. It is attributed to SilentRansomGroup (Russia) with medium confidence, affects Troutman Pepper Locke LLP Corporate IT Infrastructure, maps to 22 MITRE ATT&CK techniques (T1003.001, T1005, T1021.001), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 1SilentRansomGroup
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-2103
- Threat ID
- TL-2026-2103
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- SilentRansomGroup
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- legal, financial-services, insurance, health
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Troutman Pepper Locke LLP Data Theft Extortion by
Malware and tooling: AnyDesk, leakeddata, AnyDesk, Atera, Bomgar, Quick Assist, Rclone - S1040, RustDesk, Splashtop, SuperOps, WinSCP, Zoho Assist
How Troutman Pepper Locke LLP Data Theft Extortion by works
SilentRansomGroup (UNC3753/Luna Moth/Chatty Spider) added Am Law 50 firm Troutman Pepper Locke to its LEAKEDDATA leak site on August 18, 2026, claiming this is the second time they have breached the firm within a year. The group stated the first attack involved physical intrusion into the firm's premises to exfiltrate data via USB storage devices — a signature tactic documented by the FBI and Mandiant. SilentRansomGroup is a Conti/Ryuk offshoot that exclusively conducts data-theft extortion without encryption, using callback phishing/vishing to deploy commercial RMM tools, exfiltrating data within a single business day, and demanding ransom under a 3-day deadline with threats to notify clients and regulators.
On August 18, 2026, the threat intelligence team at ThreatMon detected and reported that SilentRansomGroup (also tracked as UNC3753, Luna Moth, Chatty Spider, and LeakedData) listed Troutman Pepper Locke LLP as a victim on its dark web LEAKEDDATA leak site at business-data-leaks[.]com. The group posted a statement declaring this was the "2nd time we attacked them in a year (first time through physical intrusion), will continue our attacks." The claim indicates a persistent, targeted campaign against one of the largest law firms in the United States.
SilentRansomGroup is a financially motivated cyber extortion group active since at least March 2022, originating from the Ryuk/Conti ransomware syndicate. The group initially deployed LOCKBIT.BLACK ransomware but pivoted by 2025 to pure data-theft extortion — stealing sensitive data and threatening its publication rather than deploying encryption. The group has been the subject of a May 2025 FBI Cyber Flash Alert, a January-May 2026 Mandiant campaign analysis, and a June 2026 Cloud Security Alliance research note, all documenting their novel hybrid approach combining remote social engineering with in-person physical office intrusions.
The group's standard attack chain unfolds within a single business day, often in under one hour. Attackers first send benign invoice-themed phishing emails from consumer email accounts with no malicious links or attachments, establishing a pretext for follow-up phone calls. In the second stage, they impersonate the target organization's internal IT helpdesk or security team via direct phone calls (vishing), fabricating urgency around security issues or data migrations. They direct the target to join a screen-sharing session via Microsoft Teams, Zoom, Quick Assist, or Windows Terminal Services, then convince them to install legitimate Remote Monitoring and Management (RMM) tools such as AnyDesk, Zoho Assist, Bomgar, SuperOps, Splashtop, or Atera. Installation commands are transmitted via privnote[.]com self-destructing messages to eliminate forensic artifacts.
Once remote access is achieved, the attackers pivot to corporate VDI environments from compromised BYOD endpoints, using Windows 365 or Citrix clients. They conduct system enumeration, crawl mapped network drives, and specifically target document management platforms such as iManage using keyword searches for tax records (W-2, W-9, 1099), audit files, corporate client agreements, and Social Security numbers. Staged data is compiled in the user's Downloads folder or Roaming profile path, then exfiltrated via WinSCP, Rclone (often renamed), or browser-based drag-and-drop uploads to actor-controlled Google Drive and OneDrive accounts. In one documented Mandiant case, 1.7 GB was exfiltrated from OneDrive to Google Drive followed by an additional 14.4 GB via WinSCP from a VDI session.
Extortion demands arrive within 30 minutes of the attackers exiting the environment. Victims receive a 3-day deadline to respond, with explicit threats to call and email the target's employees and external clients directly, publish stolen archives on the LEAKEDDATA leak site, and expose victims to regulatory fines and client lawsuits. The group operates fast-flux DNS infrastructure using residential proxy networks across Latin America, Eastern Europe, Central Asia, the Middle East, and Asia, making takedowns difficult.
A particularly alarming evolution is the group's use of physical in-person intrusions. When remote social engineering fails, the group sends individuals to the victim's physical office location posing as IT technicians needing to "image the device" or create local backups. Once granted physical access, they exfiltrate corporate data directly to external USB storage devices. The FBI confirmed this tactic in a Cyber Flash Alert (IC3 CSA 2026/260526), and CNN reported in June 2026 on a similar incident where a law firm executive received a vishing call and an alleged IT visitor physically appeared at the office, only fleeing when the employee approached the front desk. The group has victimized at least 38 law firms and over 100 total organizations as of mid-2026.
Troutman Pepper Locke LLP is an Am Law 50 firm formed January 1, 2025, from the merger of Troutman Pepper and Locke Lord. It employs over 1,600 attorneys across 30+ offices (including London) with 419 equity partners, generating $1.85 billion in gross revenue in 2025. The firm's six strategic industry focuses span Energy, Financial Services, Health Care and Life Sciences, Insurance and Reinsurance, Private Equity, and Real Estate, giving it access to highly sensitive client data including M&A transaction details, trade secrets, regulatory filings, and personally identifiable information. The firm operates its own award-winning Privacy + Cyber practice that handles thousands of security incidents for clients, but now faces a significant extortion event against its own systems. As of available reporting, Troutman Pepper Locke has not issued a public statement acknowledging the breach. The full scope of accessed data, ransom demands, and technical attack method for this specific incident remain unconfirmed by independent sources beyond the group's claims.
MITRE ATT&CK techniques used in TL-2026-2103
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory
Collection
T1005 Data from Local System; T1213.002 Data from Information Repositories: SharePoint; T1530 Data from Cloud Storage
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Exfiltration
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol; T1052.001 Exfiltration over USB; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File
Initial Access
T1133 External Remote Services; T1566.004 Phishing: Spearphishing Voice
Discovery
command-and-control
defense-impairment
T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Command and Control
Impact
Affected products and versions in Troutman Pepper Locke LLP Data Theft Extortion by
- Troutman Pepper Locke LLP — Corporate IT Infrastructure
Vulnerable versions: Entire corporate environment
Remediation for Troutman Pepper Locke LLP Data Theft Extortion by
Immediate actions
- Block all known IOC IP ranges (192.236.147.0/24, 193.141.60.0/24, 64.94.84.0/24, 174.169.162.0/24) at perimeter
- Monitor DNS logs for domains matching <org>-itdesk[.]com, <org>-it[.]com, <org>-helpdesk[.]com patterns and block
- Alert on unauthorized installation of AnyDesk, Zoho Assist, Bomgar, SuperOps, Splashtop, Atera, RustDesk, or Quick Assist
- Monitor for WinSCP or Rclone connections to unknown external IP addresses
- Enforce conditional access policies restricting VDI/VPN access to corporate-managed devices only
- Disable USB mass storage write access via GPO/MDM on all endpoints including BYOD systems
Workarounds
- Front-desk personnel should verify all IT visitors against pre-scheduled work orders through official channels
- Staff should be instructed that IT will never ask them to install remote access tools or initiate unexpected screen-sharing sessions
- Implement policy requiring out-of-band phone verification for any IT support call initiated by an unexpected contact
Longer-term hardening
- Implement out-of-band identity verification for all external contractors and IT visitors
- Require visitor escort by corporate supervisor at all times for physical access
- Conduct organization-wide vishing/social engineering awareness training
- Deploy application control (WDAC, EPP) to block unauthorized RMM and screen-sharing software
- Enable real-time alerts in document management platforms (iManage, SharePoint) for rapid file searches, bulk downloads, and search-term spikes
- Implement step-up MFA on critical data repositories including document management systems
- Monitor SSH traffic (port 22) from VDI environments for high-volume WinSCP or Rclone transfers
Timeline of Troutman Pepper Locke LLP Data Theft Extortion by
- SilentRansomGroup (as UNC3753/Luna Moth) first observed active, originating from the Ryuk/Conti ransomware syndicate, initially deploying LOCKBIT.BLACK ransomware
- FBI observes SRG escalating tactics to include in-person physical office intrusions — sending individuals posing as IT technicians to law firm offices and exfiltrating data via USB storage devices
- FBI issues Cyber Flash Alert (IC3 CSA 2026/260526) specifically warning US law firms about Silent Ransom Group targeting with callback phishing, RMM tool abuse, and physical intrusion tactics
- SilentRansomGroup conducts its first known attack on Troutman Pepper Locke (approximate date; within one year of the August 2026 repeat attack). The group claimed this first intrusion was accomplished via physical office access with data exfiltration via USB storage devices
- Mandiant identifies a campaign targeting dozens of US law firms and professional services organizations over January through May 2026, attributed to UNC3753/SilentRansomGroup
- BleepingComputer publishes detailed analysis of SRG's fake IT support call campaigns targeting law firms; Mandiant/Google Cloud publishes deep technical analysis of the UNC3753 attack lifecycle
- Cloud Security Alliance publishes research note on UNC3753 detailing the group's vishing and physical intrusion tactics, confirming at least 38 law firms and over 100 total organizations victimized
- CNN reports on SRG's physical intrusion tactics, describing how cybercriminals hire individuals to physically visit law firm offices posing as IT support, with at least one documented incident where the impersonator fled when approached
- SilentRansomGroup lists Troutman Pepper Locke on its LEAKEDDATA leak site (business-data-leaks[.]com), detected by ThreatMon at 22:51 UTC. The group states: '2nd time we attacked them in a year (first time through physical intrusion), will continue our attacks'
- HookPhish and UnderCode News publish coverage of the Troutman Pepper Locke ransomware listing. No official statement from the firm has been issued. The nature and scope of accessed data remain unconfirmed by independent sources
Sources cited for Troutman Pepper Locke LLP Data Theft Extortion by
- Ransomware Group SilentRansomGroup Hits Troutman Pepper Locke
- SilentRansomGroup Targets Troutman Pepper Locke (ThreatMon Detection)
- Targeted Campaign Against US Law Firms (Mandiant/Google Cloud)
- Silent Ransom Group Targeting US Law Firms — FBI Cyber Flash Alert
- CSA Research Note: UNC3753 Silent Ransom Vishing and Physical Intrusion
- Silent Ransom Group targets law firms with fake IT support calls
- Cybercriminals hiring burglars to target US law firms (CNN)
- Dark Web Profile: Silent Ransom Group / LeakedData (SOCRadar)
- FBI warning: Silent Ransom Group sending people to offices (CyberScoop)
- Troutman Pepper Locke — Official Firm Website
- VirusTotal GTI Collection — UNC3753 Indicators
Detection coverage for TL-2026-2103
As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2103 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.