Phone Manipulation Replaces Malware as Silent Ransom Group Targets Law Firms
The cybercriminal group allegedly extracted millions from 27 firms in six months using phone calls and manipulation rather than malware or file encryption.
Key points
- Silent Ransom Group allegedly extorted $207 million from 27 law firms.
- The group relied on social engineering and phone calls, not encryption.
- The campaign targeted law firms exclusively over a six-month period.
Silent Ransom Group allegedly extorted $207 million from 27 law firms in a six-month period using social engineering rather than traditional ransomware tactics, according to Security Affairs. The group did not encrypt files or deploy malware payloads. Instead, attackers relied on phone calls and psychological manipulation to force payments from victims who feared reputational damage or data leaks.
The operation generated significant revenue without the technical complexity of encrypting victim data. Security Affairs reports that the group targeted almost entirely law firms. The attackers used direct communication channels to pressure victims into paying ransoms. This approach bypasses traditional endpoint detection systems that look for malicious code execution or file modification events.
Operational Context
The success of this campaign highlights a shift in how some threat actors operate. Silent Ransom Group does not rely on encryption to hold data hostage. According to Security Affairs, there was no malware payload involved in these specific extortion attempts. The group demonstrated that social engineering can be as profitable as technical exploits when targeting sectors with high sensitivity to data privacy and client confidentiality.
Law firms are particularly vulnerable to this type of attack due to the sensitive nature of their work. Clients expect strict confidentiality, and firms risk severe legal and reputational consequences if data is exposed. Attackers exploit this fear. They do not need to steal large volumes of data to succeed; they only need to convince the victim that a breach has occurred or is imminent. The six-month timeframe suggests a sustained and focused campaign rather than opportunistic attacks.
Who Is Affected
The primary victims in this reported campaign were law firms. Security Affairs identified 27 specific firms that were targeted and extorted. The total amount extracted was $207 million. While the report focuses on law firms, the methodology used by Silent Ransom Group could theoretically apply to other sectors that handle sensitive personal or corporate data. However, the current evidence points to a specialized focus on the legal industry.
Business leaders in the legal sector should recognize that their security posture is not just about technical defenses. The human element remains the weakest link in many organizations. Attackers are increasingly looking for ways to bypass firewalls and antivirus software by targeting employees directly. Phone calls and social engineering are low-tech but high-impact tools that require different defensive strategies than traditional cyberattacks.
Our take on the response
Organizations must update their incident response plans to include social engineering scenarios. Traditional security training often focuses on phishing emails, but voice-based attacks are equally dangerous. Employees need to know how to verify the identity of callers claiming to be from IT or security teams. Verification processes should be strict and multi-layered.
There is no software patch that can stop a phone call. Security leaders must invest in employee awareness and verification protocols. The financial impact of these attacks is significant, as shown by the $207 million figure. Preventing these losses requires a cultural shift toward skepticism and verification. Organizations should assume that attackers will try to manipulate staff directly.
Background: Incident response plans
Incident response plans are written procedures that tell teams exactly what to do during a cyber attack. They reduce chaos, limit data loss, and speed up recovery. Without them, staff guess at actions, extending the window of compromise and increasing legal and financial liability.
Read the full guide: Incident Response Plans: How to Stop Damage When Attacks Happen
What to do and how to stay safe: Silent Ransom Group
- Verify all urgent requests for payment or data access through secondary channels such as official email or in-person confirmation.
- Train employees to recognize social engineering tactics used in phone calls, including urgency and threats of legal action.
- Implement strict verification protocols for any claim of a security breach or data leak before taking action.
- Review incident response plans to ensure they cover non-technical attacks like extortion via social engineering.
Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Silent Ransom Group use malware to steal data?
No, according to Security Affairs, the group did not use malware payloads or encrypt files.
How much money did the group allegedly extort?
The group allegedly extorted $207 million from 27 law firms in six months.
Who were the primary targets of this campaign?
The campaign targeted law firms almost exclusively, according to the report by Security Affairs.
