Silent Ransom Group uses fake IT support calls to raid law firm data

Cybersecurity firm Mandiant reports that the Silent Ransom Group is conducting aggressive social engineering campaigns against U.S. law firms and professional services organizations. Attackers send benign invoice-themed phishing emails as a prelude to voice calls impersonating IT staff, tricking employees into installing remote access tools during fake support sessions. Once inside, they rapidly exfiltrate sensitive legal and financial documents and issue ransom demands within 30 minutes, threatening to contact clients directly if unpaid. Both Mandiant and the FBI urge organizations to verify IT support requests, limit remote access tools, enforce MFA, and train staff to recognize voice phishing.