The Silent Ransom Group is conducting social engineering attacks against U.S. law firms and professional services companies, stealing data within hours of initial contact through fake IT support calls, according to Mandiant.
Cybersecurity firm Mandiant has documented an active campaign by the Silent Ransom Group targeting the legal sector. The extortion gang uses fraudulent IT support calls to infiltrate networks, gaining rapid access to sensitive information.
The attacks exploit a common vulnerability: employees' trust in IT support requests. Attackers impersonate legitimate technical personnel, convincing staff to grant access or disclose credentials. Once inside, the group moves quickly to locate and exfiltrate data.
Law firms represent high-value targets due to their access to confidential client information, financial records, and intellectual property. The professional services sector faces similar risks from the same threat group.
Mandiant's report indicates the group operates with operational speed and precision. Data theft typically occurs within hours of the initial social engineering contact, minimizing the window for detection and response.
The Silent Ransom Group follows an extortion model typical of modern ransomware operations: steal sensitive data, then demand payment in exchange for non-disclosure or file decryption. The targeting of law firms suggests the group has identified this sector as particularly susceptible to pressure from potential data breaches involving client confidentiality.
Organizations are advised to implement multi-factor authentication, conduct regular security awareness training focused on social engineering tactics, and establish verification protocols for IT support requests. Internal IT teams should maintain updated contact lists and encourage employees to verify support requests through secondary channels before granting access.
The report underscores the continued effectiveness of social engineering as an attack vector, despite widespread awareness campaigns. Law firms and professional services organizations should review their incident response procedures and ensure rapid notification protocols are in place for suspected breaches.
SonicWall has warned customers of two new zero-day vulnerabilities in its SMA1000 appliances being chained together in active remote code execution attacks.
A newly launched dark web marketplace is selling digital scans of over 153 million driver's licenses from U.S. and Canadian residents. The FBI's New Orleans field office has opened an investigation into the breach, which appears to originate from a Louisiana-based identity verification company.
Five Venezuelan nationals have pleaded guilty to conducting ATM jackpotting attacks across the United States, using malware to extract cash from automated teller machines.
Hackers infiltrated thousands of Dropbox accounts last month, accessing and downloading user files stored on the cloud platform. The company confirmed the breach in a statement reviewed by Bloomberg News.