A leak of chat logs from two of Silent Ransom Group's own servers, covering roughly August 2025 to September 2026, has put numbers to a kind of attack that defeats most of what a small business buys. The group's internal records claim that 27 law firms paid around 207 million US dollars between April and September 2026. Crystal Intelligence, which examined the cryptocurrency transactions, says blockchain data supports the overall scale of the operation but does not confirm the exact amounts. Treat the figure as the gang's own bookkeeping rather than an audited total. The method is what matters here, and the method is a phone call.
How it works
There is no encryption. Nothing gets locked. The group, also tracked as UNC3753, Luna Moth and Chatty Spider, either sends staff a fake invoice designed to make them call a support number, or calls them directly posing as the company's IT help desk. The pitch is routine: we need to fix something on your machine, join this remote support session. The session runs through ordinary tools, often Microsoft Teams or Zoom, because those are already trusted and already installed. Once the attacker has hands on the machine, they find and copy data, then threaten to publish it unless paid.
The FBI's May 2026 FLASH alert on the group adds a detail worth sitting with: in some cases they have sent a person physically to the victim's premises to get at computers directly.
Why this beats your security stack
Nearly every security product a small business owns is built to catch malicious software. Antivirus, endpoint protection, email filtering and backups all assume something bad gets installed or encrypted. This attack installs nothing bad. It uses a legitimate remote-support tool, launched by an employee who was asked nicely, during business hours, by someone who sounded like the help desk. Multi-factor authentication does not help, because nobody is logging in as anyone. Your backups do not help, because nothing was destroyed. The leverage is purely the threat of publishing what they took.
It also explains the target choice. Law firms hold concentrated, highly sensitive client material and face reputational and regulatory pressure to make a problem go away quietly. That logic applies just as neatly to a small accounting practice, a clinic, an insurance brokerage or any advisory firm holding other people's confidential files.
What to actually do
- Establish one rule: IT never cold-calls you. Write it down, say it out loud, repeat it. If someone calls claiming to be support, the answer is always to hang up and call the known number yourself.
- Publish the real number. People fall for fake support because they do not know the genuine route. Put your IT provider's actual number somewhere everyone can find it in ten seconds.
- Control who can start a remote session. If remote-support tools are installed, restrict who can accept an inbound session, and make unexpected session requests something people report rather than approve.
- Treat an invoice with a phone number as suspicious by default. The fake-invoice lure exists to make you dial them, which reverses the usual direction of a scam and bypasses email filtering entirely.
- Reduce what one laptop can reach. If a single compromised machine can browse every client file, the damage of one bad phone call is your whole document store.
- Rehearse the extortion scenario, not just ransomware. Your incident response plan should answer what you do when nothing is broken but someone has your files.
The takeaway
The uncomfortable lesson of this leak is that the most profitable attack on professional services right now requires no exploit, no malware and no clever technical trick. It requires a convincing voice and an employee who has never been told that IT does not call you. That gap costs nothing to close, and closing it is worth more than the next product you were going to buy.