Key points
- Silent Ransom Group allegedly extracted $207 million from 27 law firms over six months.
- The operation relied on phone calls and social engineering rather than malware or encryption.
- Security Affairs reported the group targeted legal organisations without locking victim files.
The short version
- Silent Ransom Group allegedly extorted $207 million from 27 law firms in six months.
- Attackers used phone calls and social engineering, avoiding malware or file encryption.
- The campaign targeted legal sectors specifically, achieving high success rates without technical payloads.
The details
According to a report by Security Affairs, the Silent Ransom Group has allegedly extorted $207 million from 27 law firms within a six-month period. This financial figure represents the total alleged extortion amount gathered through a campaign that largely bypassed traditional cyber-defences. The attackers focused their efforts almost entirely on legal organisations, exploiting the sector’s reliance on human interaction and sensitive data handling.
The method employed by this group differs significantly from typical ransomware operations. Instead of deploying malware to encrypt files and lock users out of their systems, the attackers relied on phone calls and social engineering. This approach meant that no malware payload was delivered to the victims' networks. The absence of technical intrusion tools made the attacks harder to detect through standard endpoint security monitoring.
Security Affairs noted that the group’s strategy appears to work extraordinarily well against its targets. By manipulating victims over the phone, the attackers could extract funds without leaving the digital footprints associated with encryption keys or ransomware binaries. This non-technical approach highlights a shift in how some threat actors operate, prioritising human manipulation over software exploitation.
The context
The reliance on social engineering over encryption represents a significant evolution in extortion tactics. Traditional ransomware alerts are triggered by rapid file modification or known malicious signatures. However, phone-based extortion leaves no such trace on the victim’s devices. This makes the attacks invisible to many automated security systems that monitor for code execution or data exfiltration patterns.
Law firms remain high-value targets due to the sensitive nature of the data they hold and their frequent need for urgent fund transfers. Attackers leverage these operational pressures to create urgency and bypass verification protocols. The success of this campaign suggests that technical defences alone are insufficient against adversaries who target the human element of an organisation.
Defender's checklist
Organisations should review their protocols for handling unsolicited requests for funds or sensitive information. Staff involved in financial transactions must be trained to verify identities through established, out-of-band channels. Leadership should ensure that emergency procedures do not allow single individuals to authorise large payments without secondary confirmation.
What to do and how to stay safe: Silent Ransom Group
- Verify all requests for fund transfers or sensitive data through a separate, pre-established communication channel.
- Train staff to recognise pressure tactics and urgency cues commonly used in social engineering attacks.
- Monitor for unusual communication patterns, such as calls from unknown numbers requesting immediate action.
- Review incident response plans to include procedures for non-technical extortion attempts.
Step-by-step guide: What is online tracking: how data follows you and how to stop it
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Silent Ransom Group use malware to extort the law firms?
No, according to Security Affairs, the group did not use malware or encryption, relying instead on phone calls.
How much money was allegedly extorted by the Silent Ransom Group?
The group allegedly extorted $207 million from 27 law firms over a six-month period.
Why did the attackers target law firms?
The group targeted law firms almost exclusively, likely due to the sensitive nature of their data and operations.
