# Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusion

> Silent Ransom Group (SRG), aka Luna Moth and Chatty Spider, is running an active callback-phishing and vishing campaign against US law firms, impersonating IT helpdesk staff by phone and email to obtain remote access via legitimate RMM tools, then escalating to physical on-site intrusion when remote tactics fail. The group exfiltrates sensitive data (no encryption) and extorts victims for multi-million-dollar payments, including a disclosed $20 million demand in May 2026.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2176
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-luna-moth-physical-intrusion-extortion-tl-2026-2176.webp?v=8cc4f951 (Threadlinqs threat intel: Silent Ransom Group Law Firm Extortion: Detection & IOCs (TL-2026-2176) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2176
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Silent Ransom Group
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (2 shown free below)

## Description

Silent Ransom Group is a financially motivated data-extortion actor that split from the Conti ransomware syndicate in March 2022 and grew out of the earlier BazarCall/BazarBackdoor callback-phishing operation. Rather than deploying ransomware encryptors, SRG steals sensitive files and threatens public disclosure unless paid. Since Spring 2023 the group has consistently targeted US-based law firms, with secondary targeting of insurance, finance, healthcare, and accounting organizations, prizing the high extortion leverage of privileged legal and client data.

The group's initial access relies on telephone-oriented attack delivery (TOAD): phishing emails disguised as subscription or online-class invoices instruct the recipient to call a helpdesk number to dispute a pending charge, or attackers cold-call employees directly claiming to be internal IT staff. Both paths funnel the victim into a live phone conversation where the actor talks them into joining a remote-support session and installing a legitimate remote monitoring and management (RMM) tool — observed tools include Zoho Assist, Syncro, SuperOps, Atera, AnyDesk, Splashtop, RustDesk, and Microsoft Quick Assist. Because these are digitally signed, widely used administration tools, the technique evades both signature-based and behavioral detection and leaves few forensic artifacts.

EclecticIQ assessed with high confidence (March 2025) that SRG had registered at least 37 typosquatted helpdesk domains through GoDaddy (patterns such as "[company]-helpdesk[.]com") to support the callback lures. Around March 2025 the group's tradecraft shifted further toward direct, unsolicited vishing calls rather than waiting for victims to dial in, and beginning in Spring 2025/2026 SRG began sending an operative to physically visit a target's office posing as IT/support staff, where they insert USB storage devices or external drives directly into workstations to image data when remote access is blocked or insufficient — a tactic the FBI's May 2026 Flash Report (FLASH-20260526-01) confirmed as an active, escalating technique.

Once access is established, SRG performs minimal privilege escalation and searches local files and network shares for sensitive material (client files, case notes, financial records, regulatory correspondence), then exfiltrates it using WinSCP (including a portable, non-admin variant) over SFTP, or Rclone — sometimes hidden or renamed to evade detection — to cloud storage such as MEGA, Google Drive, and Microsoft OneDrive. Persistence, where obtained, has used Syncro. Following exfiltration, SRG sends extortion emails and places direct phone calls to employees and even clients to apply pressure, demanding payment (historically 2-78 BTC, and $1-8 million USD in FBI-reported cases, with a $20 million payment from an unnamed US law firm disclosed in May 2026) and threatening to publish data on its clearweb leak site (business-data-leaks[.]com per the FBI Flash Report).

The FBI and IC3 have issued at least two public advisories (May 2025 and May 26, 2026) as reported intrusion activity accelerated, with Mandiant documenting a concentrated wave of law-firm breaches between January and May 2026.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1598.004 Phishing for Information: Spearphishing Voice
- T1583.001 Acquire Infrastructure: Domains
- T1588.002 Obtain Capabilities: Tool
- T1566.001 Phishing: Spearphishing Attachment
- T1566.004 Phishing: Spearphishing Voice
- T1204.001 User Execution: Malicious Link
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Silent Ransom Group — Typosquatted Helpdesk Domain Contact Following Invoice Lure Click** (`TL-2026-2176-SPL-001`)

Detects a workstation resolving or connecting to a domain matching the SRG/Luna Moth typosquatted-helpdesk registration pattern ([company]-helpdesk[.]com, e.g. vorys-helpdesk.com, registered via GoDaddy/domaincontrol.com nameservers) shortly after the same user received or opened a subscription/invoice-themed email — the callback-phishing (TOAD) lure that funnels victims into a fraudulent IT support call.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1591, T1566.004, T1583.001, T1036.005
- **Data sources:** zscaler_proxy, cisco_umbrella_dns, o365_management_activity, proofpoint_email
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype=zscaler OR sourcetype=bluecoat OR sourcetype=cisco:umbrella OR sourcetype=palo:traffic)
| rex field=dest_host "(?<lure_domain>[a-z0-9\-]+\-helpdesk\.(com|net|org))"
| where isnotnull(lure_domain) OR match(dest_host, "(?i)business\-data\-leaks\.com") OR match(dns_answer, "(?i)domaincontrol\.com")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as contacted_domains values(dns_answer) as ns_records by src_ip, user
| join type=left user
    [ search index=email (sourcetype="o365:management:activity" OR sourcetype="proofpoint:email") subject="*invoice*" OR subject="*subscription*" OR subject="*charge*"
      | stats count as invoice_email_count min(_time) as email_time by user ]
| where count>0
| sort -first_seen
```

### Microsoft KQL

```kql
let LureDomains = dynamic(["business-data-leaks.com"]);
EmailEvents
| where Timestamp > ago(24h)
| where Subject has_any ("invoice", "subscription", "pending charge")
| project SenderFromAddress, RecipientEmailAddress, Subject, EmailTime = Timestamp
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl matches regex @"[a-z0-9\-]+-helpdesk\.(com|net|org)" or RemoteUrl has "business-data-leaks.com"
    | project DeviceName, AccountName, RemoteUrl, ConnectTime = Timestamp
) on $left.RecipientEmailAddress == $right.AccountName
| where ConnectTime - EmailTime between (0min .. 240min)
| project DeviceName, AccountName, Subject, RemoteUrl, EmailTime, ConnectTime
| order by ConnectTime desc
```

### Sigma

```yaml
title: Silent Ransom Group Typosquatted Helpdesk Domain Contact
id: 6f2e3a10-9c41-4b1a-9d3e-7a1c2f5b8e01
status: experimental
description: Detects DNS resolution or proxy connection to a typosquatted [company]-helpdesk[.]com domain consistent with Silent Ransom Group / Luna Moth callback-phishing (TOAD) infrastructure
references:
    - https://www.ic3.gov/CSA/2026/260526.pdf
    - https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.reconnaissance
    - attack.t1591
    - attack.initial-access
    - attack.t1566.004
    - attack.t1583.001
    - actor.silent_ransom_group
    - actor.luna_moth
logsource:
    category: dns_query
    product: windows
detection:
    selection_lure:
        QueryName|re: '[a-z0-9\-]+\-helpdesk\.(com|net|org)$'
    selection_leaksite:
        QueryName|contains: 'business-data-leaks.com'
    condition: 1 of selection_*
falsepositives:
    - Legitimate internal helpdesk subdomains that happen to match the naming pattern (verify against organizational domain allowlist)
level: high
```

**Known false positives:**

- Legitimate company-run helpdesk subdomains that coincidentally match the -helpdesk naming convention

**Tuning notes:** Maintain an allowlist of verified internal helpdesk/ticketing domains and exclude them from the lure_domain match; extend the regex list as new EclecticIQ/FBI-reported typosquat domains are disclosed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Silent Ransom Group — Invoice-Themed Vishing Lure Email with Callback Phone Number (locked: unlock with TL Creds)
- Silent Ransom Group — Physical Intrusion USB Insertion Following RMM Session on Sensitive-Department Workstation (locked: unlock with TL Creds)
- Silent Ransom Group — Syncro Persistence Agent Installed Outside Change Window (locked: unlock with TL Creds)
- Silent Ransom Group — Impersonation of Legitimate Helpdesk Platform (Reamaze) During Support Session (locked: unlock with TL Creds)
- Silent Ransom Group — Local and Network Share Enumeration Preceding Bulk File Access (locked: unlock with TL Creds)
- Silent Ransom Group — Extortion Communication Referencing Leak Site or Large BTC/USD Demand (locked: unlock with TL Creds)
- Silent Ransom Group — Unauthorized RMM Tool Installation on Endpoint (locked: unlock with TL Creds)
- Silent Ransom Group — WinSCP/Rclone Bulk Exfiltration to Cloud Storage (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 24)

Defanged, TLP:CLEAR.

- Domain: `business-data-leaks[.]com`
- Domain: `vorys-helpdesk[.]com`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Cyber Intelligence Briefing - 12 June 2026](https://www.s-rminform.com/cyber-intelligence-briefing/cyber-intelligence-briefing-12-june-2026)
- [Silent Ransom Group Impersonating IT Personnel through Social Engineering (CSA)](https://www.ic3.gov/CSA/2026/260526.pdf)
- [FBI Flash Report TLP Clear: Silent Ransom Group Impersonating IT Personnel](https://www.aha.org/cybersecurity-government-intelligence-reports/2026-05-26-fbi-flash-report-tlp-clear-silent-ransom-group-impersonating-it)
- [Silent Ransom Group Targeting Law Firms](https://www.fbi.gov/file-repository/cyber-alerts/silent-ransom-group-targeting-law-firms-052325.pdf/view)
- [Threat Assessment: Luna Moth Callback Phishing Campaign](https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/)
- [Luna Moth extortion hackers pose as IT help desks to breach US firms](https://www.bleepingcomputer.com/news/security/luna-moth-extortion-hackers-pose-as-it-help-desks-to-breach-us-firms/)
- [FBI warns of Luna Moth extortion attacks targeting law firms](https://www.bleepingcomputer.com/news/security/fbi-warns-of-luna-moth-extortion-attacks-targeting-law-firms/)
- [Silent Ransom Group (Luna Moth) Extortion Attacks Target US Law Firms via Remote Access Tools and Social Engineering](https://www.rescana.com/post/silent-ransom-group-luna-moth-extortion-attacks-target-us-law-firms-via-remote-access-tools-and-social-engineering)
- [Luna Moth (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/luna_moth)
- [An Old Tactic Returns: Silent Ransom Group's Active Use of Physical Intrusion Against U.S. Law Firms](https://www.halcyon.ai/ransomware-alerts/an-old-tactic-returns-silent-ransom-groups-active-use-of-physical-intrusion-against-u-s-law-firms)
- [Luna Moth Targets US Law Firms: $20M Ransom, 100+ Attacks](https://shattered.io/luna-moth-silent-ransom-group-law-firms-2026/)
- [Hackers Are Calling Your Office: FBI Alerts Law Firms to Luna Moth's Stealth Phishing Campaign](https://thehackernews.com/2025/05/hackers-are-calling-your-office-fbi.html)
- [This hacker group is posing as IT helpdesk workers to target enterprises](https://www.itpro.com/security/this-hacker-group-is-posing-as-it-helpdesk-workers-to-target-enterprises-and-researchers-warn-its-social-engineering-techniques-are-exceptionally-hard-to-spot)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2176