--- title: Silent Ransom Group targets law firms with fake IT... description: The Silent Ransom Group (tracked as UNC3753, Luna Moth, Chatty Spider) is actively targeting U.S. law firms and professional services organizations using... canonical: https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Silent Ransom Group targets law firms with fake IT support calls | daily.dev og:description: The Silent Ransom Group (tracked as UNC3753, Luna Moth, Chatty Spider) is actively targeting U.S. law firms and professional services organizations using... og:url: https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe og:image: https://api.daily.dev/og/posts/WTSTzyOXE.png og:image:alt: Silent Ransom Group targets law firms with fake IT support calls og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Silent Ransom Group targets law firms with fake IT support calls **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 0 upvotes · 0 comments ## Summary The Silent Ransom Group (tracked as UNC3753, Luna Moth, Chatty Spider) is actively targeting U.S. law firms and professional services organizations using callback phishing attacks. The campaign begins with invoice-themed phishing emails followed by phone calls where attackers impersonate IT help desk staff, convincing employees to join remote support sessions via Teams, Zoom, or Quick Assist. Victims are then tricked into installing RMM tools like AnyDesk or Zoho Assist, granting attackers network access. Once inside, the group exfiltrates sensitive legal and financial documents using WinSCP or Rclone, then sends aggressive extortion demands within 30 minutes of exiting the environment — giving victims a three-day deadline. The group also uses fast-flux DNS infrastructure to protect its data-leak platforms. Mandiant and the FBI recommend strict IT verification procedures, MFA enforcement, limiting remote access tools, and employee training on voice phishing. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Ongoing Targeted Campaign Against US Law Firms](https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn) · Google Cloud · 0 upvotes · 0 comments - [Google and FBI warn of ransomware group that sends fake IT workers to hack victims in person](https://daily.dev/posts/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person-ap1smzd0i) · TechCrunch · 0 upvotes · 0 comments - ['Several dozen' orgs targeted by a new extortion crew](https://daily.dev/posts/several-dozen-orgs-targeted-by-a-new-extortion-crew-hwkvov6ma) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-privacy](https://daily.dev/tags/data-privacy) [View this post on daily.dev](https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Silent Ransom Group targets law firms with fake IT support calls","url":"https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe"},"datePublished":"2026-06-07T14:20:53.356Z","dateModified":"2026-06-07T14:21:20.771Z","description":"The Silent Ransom Group (tracked as UNC3753, Luna Moth, Chatty Spider) is actively targeting U.S. law firms and professional services organizations using...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3898764e64019ae3ce7f974078374a63?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3898764e64019ae3ce7f974078374a63?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-privacy","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Silent Ransom Group targets law firms with fake IT support calls"}]} ```