Executive Summary
Silent Ransom Group (SRG), also known as Luna Moth or UNC3753, has significantly escalated its extortion activities against the US legal sector through 2025 and 2026. Unlike traditional ransomware groups, SRG utilizes a pure data-theft model without file encryption, leveraging the high coercive value of attorney-client privileged information. The group has allegedly extorted over $207 million from at least 27 organizations, including a confirmed $20 million payment from a single firm in May 2026.
The group's attack chain has evolved from callback phishing to sophisticated voice phishing (vishing) and, most notably, physical intrusions where actors pose as IT technicians to exfiltrate data via USB devices. Because SRG relies exclusively on "living off the land" (LOTL) techniques and legitimate remote monitoring and management (RMM) tools, their activities frequently bypass traditional endpoint security and signature-based detection systems.
This campaign represents a critical risk to law firms, healthcare, and financial services due to the group's operational discipline and ability to bypass network controls through physical access. The FBI has issued two FLASH alerts within 13 months, highlighting the urgency of this threat and the need for integrated physical and cybersecurity defenses.