# Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical Intrusion)

> SilentRansomGroup (UNC3753/Luna Moth/Chatty Spider) added Am Law 50 firm Troutman Pepper Locke to its LEAKEDDATA leak site on August 18, 2026, claiming this is the second time they have breached the firm within a year. The group stated the first attack involved physical intrusion into the firm's premises to exfiltrate data via USB storage devices — a signature tactic documented by the FBI and Mandiant. SilentRansomGroup is a Conti/Ryuk offshoot that exclusively conducts data-theft extortion without encryption, using callback phishing/vishing to deploy commercial RMM tools, exfiltrating data within a single business day, and demanding ransom under a 3-day deadline with threats to notify clients and regulators.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2103
- **ID:** TL-2026-2103
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** SilentRansomGroup (Russia)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 18, 2026, the threat intelligence team at ThreatMon detected and reported that SilentRansomGroup (also tracked as UNC3753, Luna Moth, Chatty Spider, and LeakedData) listed Troutman Pepper Locke LLP as a victim on its dark web LEAKEDDATA leak site at business-data-leaks[.]com. The group posted a statement declaring this was the "2nd time we attacked them in a year (first time through physical intrusion), will continue our attacks." The claim indicates a persistent, targeted campaign against one of the largest law firms in the United States.

SilentRansomGroup is a financially motivated cyber extortion group active since at least March 2022, originating from the Ryuk/Conti ransomware syndicate. The group initially deployed LOCKBIT.BLACK ransomware but pivoted by 2025 to pure data-theft extortion — stealing sensitive data and threatening its publication rather than deploying encryption. The group has been the subject of a May 2025 FBI Cyber Flash Alert, a January-May 2026 Mandiant campaign analysis, and a June 2026 Cloud Security Alliance research note, all documenting their novel hybrid approach combining remote social engineering with in-person physical office intrusions.

The group's standard attack chain unfolds within a single business day, often in under one hour. Attackers first send benign invoice-themed phishing emails from consumer email accounts with no malicious links or attachments, establishing a pretext for follow-up phone calls. In the second stage, they impersonate the target organization's internal IT helpdesk or security team via direct phone calls (vishing), fabricating urgency around security issues or data migrations. They direct the target to join a screen-sharing session via Microsoft Teams, Zoom, Quick Assist, or Windows Terminal Services, then convince them to install legitimate Remote Monitoring and Management (RMM) tools such as AnyDesk, Zoho Assist, Bomgar, SuperOps, Splashtop, or Atera. Installation commands are transmitted via privnote[.]com self-destructing messages to eliminate forensic artifacts.

Once remote access is achieved, the attackers pivot to corporate VDI environments from compromised BYOD endpoints, using Windows 365 or Citrix clients. They conduct system enumeration, crawl mapped network drives, and specifically target document management platforms such as iManage using keyword searches for tax records (W-2, W-9, 1099), audit files, corporate client agreements, and Social Security numbers. Staged data is compiled in the user's Downloads folder or Roaming profile path, then exfiltrated via WinSCP, Rclone (often renamed), or browser-based drag-and-drop uploads to actor-controlled Google Drive and OneDrive accounts. In one documented Mandiant case, 1.7 GB was exfiltrated from OneDrive to Google Drive followed by an additional 14.4 GB via WinSCP from a VDI session.

Extortion demands arrive within 30 minutes of the attackers exiting the environment. Victims receive a 3-day deadline to respond, with explicit threats to call and email the target's employees and external clients directly, publish stolen archives on the LEAKEDDATA leak site, and expose victims to regulatory fines and client lawsuits. The group operates fast-flux DNS infrastructure using residential proxy networks across Latin America, Eastern Europe, Central Asia, the Middle East, and Asia, making takedowns difficult.

A particularly alarming evolution is the group's use of physical in-person intrusions. When remote social engineering fails, the group sends individuals to the victim's physical office location posing as IT technicians needing to "image the device" or create local backups. Once granted physical access, they exfiltrate corporate data directly to external USB storage devices. The FBI confirmed this tactic in a Cyber Flash Alert (IC3 CSA 2026/260526), and CNN reported in June 2026 on a similar incident where a law firm executive received a vishing call and an alleged IT visitor physically appeared at the office, only fleeing when the employee approached the front desk. The group has victimized at least 38 law firms and over 100 total organizations as of mid-2026.

Troutman Pepper Locke LLP is an Am Law 50 firm formed January 1, 2025, from the merger of Troutman Pepper and Locke Lord. It employs over 1,600 attorneys across 30+ offices (including London) with 419 equity partners, generating $1.85 billion in gross revenue in 2025. The firm's six strategic industry focuses span Energy, Financial Services, Health Care and Life Sciences, Insurance and Reinsurance, Private Equity, and Real Estate, giving it access to highly sensitive client data including M&A transaction details, trade secrets, regulatory filings, and personally identifiable information. The firm operates its own award-winning Privacy + Cyber practice that handles thousands of security incidents for clients, but now faces a significant extortion event against its own systems. As of available reporting, Troutman Pepper Locke has not issued a public statement acknowledging the breach. The full scope of accessed data, ransom demands, and technical attack method for this specific incident remain unconfirmed by independent sources beyond the group's claims.

## MITRE ATT&CK

- T1566.004 Phishing: Spearphishing Voice
- T1133 External Remote Services
- T1204.002 User Execution: Malicious File
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1553.002 Subvert Trust Controls: Code Signing
- T1003.001 OS Credential Dumping: LSASS Memory
- T1135 Network Share Discovery
- T1219 Remote Access Tools
- T1021.001 Remote Services: Remote Desktop Protocol
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1213.002 Data from Information Repositories: SharePoint
- T1572 Protocol Tunneling
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1052.001 Exfiltration over USB
- T1657 Financial Theft

## Sources

- [Ransomware Group SilentRansomGroup Hits Troutman Pepper Locke](https://www.hookphish.com/blog/ransomware-group-silentransomgroup-hits-troutman-pepper-locke/)
- [SilentRansomGroup Targets Troutman Pepper Locke (ThreatMon Detection)](https://undercodenews.com/silentransomgroup-targets-troutman-pepper-locke-a-new-cybersecurity-alarm-for-the-legal-industry-video/)
- [Targeted Campaign Against US Law Firms (Mandiant/Google Cloud)](https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms)
- [Silent Ransom Group Targeting US Law Firms — FBI Cyber Flash Alert](https://www.fbi.gov/file-repository/cyber-alerts/silent-ransom-group-targeting-law-firms-052325.pdf)
- [CSA Research Note: UNC3753 Silent Ransom Vishing and Physical Intrusion](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA_research_note_unc3753_silent_ransom_vishing_physical_intrusion_20260608-csa-styled.pdf)
- [Silent Ransom Group targets law firms with fake IT support calls](https://www.bleepingcomputer.com/news/security/silent-ransom-group-targets-law-firms-with-fake-it-support-calls/)
- [Cybercriminals hiring burglars to target US law firms (CNN)](https://www.cnn.com/2026/06/27/politics/cybercriminals-hire-burglars-russian-us-law-firms)
- [Dark Web Profile: Silent Ransom Group / LeakedData (SOCRadar)](https://socradar.io/blog/dark-web-profile-silent-ransom-group-leakeddata/)
- [FBI warning: Silent Ransom Group sending people to offices (CyberScoop)](https://cyberscoop.com/fbi-warning-silent-ransom-group-law-firms/)
- [Troutman Pepper Locke — Official Firm Website](https://www.troutman.com/)
- [VirusTotal GTI Collection — UNC3753 Indicators](https://www.virustotal.com/gui/collection/598281d2c6de83adf1505ee6077608d0c043623d477e2884d36d65e90686d67a/summary)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2103