When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group

For law firms, some of the most consequential cyberattacks may no longer look like cyberattacks at all.

Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC 3753, has built its extortion model around a simple strategy: rather than defeating security controls with sophisticated malware, convincing legitimate users to provide access.

Sygnia’s Incident Response team first documented Luna Moth in 2022 after tracking a campaign in which false subscription invoices persuaded recipients to call attacker-controlled phone numbers. Victims were directed into remote-support sessions, after which attackers searched accessible corporate data and used the threat of disclosure to demand payment.

An employee believes they are speaking with trusted IT support, approves a remote session, and gives the attacker a path to sensitive client data. From there, legitimate identities and commercial tools can be used to search, collect and exfiltrate information before the firm receives an extortion demand.

The challenge for law firms is therefore not simply detecting malicious software. Instead, it is recognizing when legitimate access, tools and workflows are being used for an illegitimate purpose.

On-Demand Webinar

When IT Support Is the Attack:
Defending Law Firms Against
Silent Ransom Group

Watch the Replay

How Silent Ransom Group’s attack model has evolved

The group’s business model has remained consistent: steal sensitive information and turn confidentiality, reputational and regulatory exposure into extortion leverage. What changed is how attackers establish trust and gain access.

The FBI reported that SRG began consistently targeting U.S. law firms in spring 2023. More recent observed operations have included callers posing as internal IT personnel and, in some reported cases, individuals physically arriving at victim offices and attempting to connect removable storage to endpoints.

The attack path can now involve external Teams messages, help-desk impersonation, voice calls and in-person approaches. Operators may direct users toward familiar screen-sharing and remote-support technologies such as Teams, Zoom, Quick Assist, AnyDesk, RustDesk, Splashtop, Atera or Zoho Assist.

Once connected, they can search local files, mapped drives, Microsoft 365 environments and legal document-management platforms before moving information through cloud storage, WinSCP, Rclone, email or removable media.

Rather than encrypting systems, SRG uses the stolen information itself as leverage, threatening disclosure and potentially contacting employees or clients to increase pressure.

Beware of copy-cats

Sygnia has recently observed an increase in suspected copy-cat activity where third-party actor claiming to be SRG is emailing ransom notes to law firms, attempting to scam potential victims into paying a pre-breach ransom as a preventive measure. It is likely that this actor is seeking to exploit law firm concerns about SGR. Interestingly, these emails are being sent to numerous individuals, including those who left their firms 8 to 10 years ago, and are therefore hitting the firm’s spam folders.

The ‘real’ SRG continues to operate using the model described above, including publishing victim names on their leak site.

Figure 2. Sample copy-cat ransomware note

Why law firms are particularly exposed

Three characteristics make law firms particularly well suited to SRG’s attack model: they store vast amounts of sensitive client information, publicly available information that can support convincing impersonation, and working practices in which urgent support requests can appear legitimate.

One compromised identity can expose multiple clients and matters

Law firms hold precisely the type of information that makes data-theft extortion effective: privileged communications, litigation strategy, transaction documents, intellectual property, personal and financial information, and other confidential client material.

A compromised employee does not necessarily provide access to one valuable file or client. Depending on the user’s permissions, the attacker may be able to reach information across multiple matters, repositories and clients.

This makes identity-to-data access an important part of the defensive strategy. Firms should understand what sensitive information each user, partner, administrator, help-desk account and service account can reach and identify excessive access, standing privileges, weak alignment with ethical walls and unnecessary pathways for bulk download or export.

A useful question is simple: If this identity were compromised today, what client data could the attacker reach?

Attackers can make fraudulent support requests look credible

Law firms expose information that can help attackers construct convincing impersonation scenarios. Public websites, biographies and other readily available information can reveal partners and employees, roles, office locations and organizational relationships.

Combined with information gathered through reconnaissance, this can make an unexpected interaction with “IT” or another trusted party seem plausible.

That is why support identity verification should be treated as a security control rather than simply a help-desk procedure. Unexpected support interactions should be authenticated through a known internal channel, validated ticket, approved callback number or another predefined mechanism before remote access is permitted. Password and MFA resets should similarly require out-of-band verification rather than relying on the apparent identity or urgency of the requester.

These procedures should extend beyond IT. Partners, assistants, reception, facilities and third-party support personnel may all encounter a convincing support pretext.

Legitimate tools and urgent workflows can conceal the intrusion

Legal work is frequently time-sensitive. An employee dealing with a filing, closing, client request or other deadline may be especially motivated to resolve a technology problem quickly. A caller claiming to be addressing an urgent account issue, security problem or migration can use that pressure to make an unusual support request appear routine.

Once the employee cooperates, the technical activity may also look legitimate. The user may launch an approved application. The attacker may use signed commercial remote-support software. They may remain within the user’s existing permissions without deploying malware, gaining administrative privileges or encrypting systems.

That means firms need to prepare employees for the interaction, not simply generic phishing. Training should cover unsolicited IT calls, external Teams messages, fake subscription invoices, unexpected remote-support requests and, where relevant, individuals arriving onsite claiming to provide technical support. Employees also need a fast way to report an interaction as soon as something feels wrong.

Remote-support technology should be governed accordingly. Firms should maintain an approved inventory of RMM, screen-sharing and remote-access tools; define who can use them and under what circumstances; and restrict or alert on unauthorized and portable utilities where operationally feasible.

The same trust, access and tools that allow employees and IT teams to work efficiently can provide an attacker with a path to sensitive client information.

SRG cannot be addressed by one control or one security team. The attack path needs to be interrupted at multiple points, from the first support interaction through access to client data, detection of suspicious activity and the firm’s response to attempted extortion.

Seven actions law firm leaders should prioritize

SRG is not simply a security operations problem. Its attack model crosses IT support, identity, client-data access, physical security and crisis management. Reducing exposure requires clear ownership and coordinated action across the firm—not simply additional security controls.

1. Make trusted support difficult to impersonate

The first objective is to prevent a convincing interaction from becoming unauthorized access.

Establish a firm-wide requirement that unexpected support interactions are independently verified before an employee provides remote access or the help desk resets credentials or MFA. Use a simple, consistently enforced process such as a validated ticket, known internal channel or approved callback procedure and ensure urgency or seniority cannot override it.

Employees should also be trained for the interactions they are likely to encounter, not simply generic phishing. That includes unsolicited calls from “IT,” external Teams messages, unexpected remote-support requests, fake subscription invoices and, where relevant, individuals arriving onsite claiming to provide technical support.

Extend this preparation to partners, executive assistants, reception, facilities and third-party support personnel. Everyone should know how to verify a support request and how to escalate immediately when an interaction appears suspicious.

Executive question: Could someone convincingly impersonating IT persuade an employee or our help desk to provide access without independent verification?

2. Treat remote access as privileged access

Legitimate software should not automatically be considered low risk. A commercial remote-support tool can give an attacker much of the access they need without deploying malware.

Require an approved inventory of RMM, screen-sharing and remote-support tools, with clear ownership over who can use them, where they can operate and under what circumstances. Unauthorized or portable remote-access tools should be restricted or generate meaningful alerts where operationally feasible.

The goal is not to eliminate legitimate remote support. It is to ensure that an unsolicited interaction cannot become remote control of an endpoint without the firm’s knowledge and authorization.

Executive question: Do we know which remote-access tools can operate in our environment, who is authorized to use them and when they are being used?

3. Limit the blast radius of a compromised identity

The impact of an SRG intrusion depends heavily on what the compromised user can reach.

Ensure visibility into access to high-value repositories and sensitive matters across partners, employees, administrators, help-desk personnel and service accounts. Conduct periodic reviews to identify excessive standing access, privileged support accounts, weak alignment with ethical walls and unnecessary capabilities for bulk search, download or export.

This is ultimately a business-exposure question, not simply an identity-management exercise. Compromising one employee should not automatically expose a disproportionate amount of confidential client information.

Executive question: If one of our partners, administrators or support accounts were compromised today, which clients, matters and repositories would be exposed?

4. Require detection across the complete attack sequence

Detection readiness is not measured by the number of security tools deployed or alerts generated. The relevant measure is whether the firm can recognize the attack quickly enough to intervene before sensitive information leaves.

SRG activity may produce a series of individually legitimate events, such as an external Teams interaction, a remote-support session, a large document search, archive creation and an outbound transfer. Viewed separately, none necessarily indicates an intrusion. Viewed together, and connected by the same identity, endpoint and timeframe, they can tell a very different story.

Security leaders should therefore be able to correlate activity across identity, endpoints, collaboration platforms, document-management systems and egress controls. Detection should incorporate business context, including the user’s role and matter access, rather than relying primarily on isolated alerts or static volume thresholds.

Executive question: Can our security team connect weak signals across different systems quickly enough to identify this attack before sensitive client data leaves?

5. Integrate physical security into the cyber operating model

If an attacker can arrive at an office claiming to be a technician, the security boundary extends beyond the network.

Ensure that reception, facilities, IT and security use a common process for verifying unexpected technicians and other support personnel. Visitor controls, removable-media policies and physical-access records should also support investigation when suspicious activity occurs.

The objective is not to merge physical and cyber security functions. It is to prevent attackers from exploiting the gaps between them.

Executive question: What would happen if someone arrived at one of our offices tomorrow claiming IT had sent them to work on an employee’s device?

6. Define crisis authority before data is stolen

SRG can create a serious business crisis without disrupting the firm’s operations. An attacker claiming to possess privileged or confidential client information immediately raises questions involving containment, affected matters, legal obligations, cyber insurance, law enforcement, client communications and reputation.

Prepare to make these decision before the crisis, not during.

Establish clear authority for terminating remote sessions, isolating endpoints, revoking credentials and tokens, engaging external incident responders and counsel, determining potentially affected matters and controlling communications.

The response window can also be extremely compressed. Data collection may begin while the fraudulent support interaction is still underway. Firms should know who can authorize immediate containment while investigation begins to determine which repositories were accessible and what information may have been viewed or moved.

Security, executive leadership, legal, communications, insurance and external incident response stakeholders should understand how they will operate together before an extortion demand arrives.

Executive question: If an attacker claimed today to possess confidential client information, who has authority to make the critical decisions during the first hour?

7. Demand evidence that the firm can interrupt the attack

Policies, technology and playbooks provide limited assurance until they have been tested together.

Require scenario-based exercises that replicate the SRG attack path: IT impersonation, unauthorized remote access, legitimate-tool abuse, access to sensitive client repositories, attempted exfiltration and subsequent extortion.

Testing should examine both technical controls and business decision-making. Red/Purple Team exercises and controlled social engineering can test whether the attack path can succeed, while technical and executive tabletop exercises can determine whether teams recognize, escalate and respond to the resulting crisis effectively.

The outcome should not simply be another maturity score or list of observations. It should identify which attack paths remain viable, their potential business impact, the actions required to close them, accountable owners and remediation timelines.

The goal is to be able to distinguish between having controls on paper and having evidence that those controls will work together under pressure.

Executive question: What evidence do we have, not what policies do we have, that this attack would be detected and interrupted before it became a client-confidentiality crisis?

How Sygnia can help

Defending against SRG requires more than blocking a particular remote-access tool or adding another detection rule. The attack crosses help-desk processes, identities, endpoints, collaboration platforms, client-data repositories, egress controls and potentially physical security. An effective defense therefore needs to address the attack path as a connected scenario.

Sygnia helps law firms both defend against and respond to active SRG incidents by testing whether their defenses can interrupt the attack before sensitive client data is stolen and detecting the weak signals associated with legitimate-tool abuse.

Rapid incident response

Our Incident Response Team includes the experts who first identified and named Luna Moth in 2022. When an incident occurs, our responders work quickly to contain access, determine which identities, endpoints and repositories were compromised, establish what data may have been viewed or exfiltrated, and support the firm through recovery and crisis management.

Managed Detection and Response

Sygnia MDR applies frontline incident response expertise to continuously monitor available telemetry across identities, endpoints, cloud environments and data-transfer activity. By connecting signals such as unauthorized remote-access software, abnormal repository activity and unusual outbound transfers, our experts can identify and investigate activity that may appear legitimate when viewed in isolation.

Targeted readiness assessment

Sygnia can assess a firm’s ability to prevent, detect and respond to IT-support impersonation and related SRG tactics. This assessment can examine help-desk verification procedures, remote-access governance, identity-to-data permissions, physical-security coordination, telemetry coverage and response authority. Targeted Red and Purple Team exercises and executive tabletop simulations can then validate whether these controls will work together under realistic conditions and identify the highest-priority gaps to address.

Suspect an incident? Sygnia provides 24/7 incident response coverage at +1-877-686-8680.