Executive Summary

Silent Ransom Group is a financially motivated data-extortion group active since at least 2022. It steals data and extorts victims without encrypting files. Researchers assess it as an offshoot of the defunct Conti ransomware gang. It briefly deployed LockBit Black in 2022 and has focused on extortion-only operations since then. Its leak site is a clearnet domain, not a Tor service, and it has become the group's main pressure tool.

The group has targeted US-based law firms consistently since spring 2023, and also hits insurance, finance and healthcare organisations. Initial access is human-driven. Callers pose as IT support, talk employees into installing legitimate remote-access tools, and steal files within hours. If remote attempts fail, the group sends someone in person to plug a USB drive into a victim's computer. Almost no malware is involved, so antivirus rarely flags the intrusions.

Activity has escalated sharply through 2026. Listings show 4 in January, about 16 in April, and 17–18 in each of August and September. In August the group introduced redacted "full data timer" listings, and it has begun re-attacking firms that refuse to pay. Ransom demands are large. Reported demands range from $1 million to $8 million. In the latest case the group asked a global firm for at least $20 million and, by the group's own account, rejected offers of up to $5.34 million. The main risk for defenders is not detection of malware but the human and physical attack surface: help desk verification, remote-access tool control, USB and visitor control, and bulk-data exfiltration monitoring.

Threat Profile

Group Overview

Origin and lineage. It shares tactical overlaps with the BazarCall campaigns of 2021, but relies on remote monitoring and management (RMM) tools rather than the earlier BazarLoader and TrickBot malware. One report notes the group avoids targets in ex-Soviet and CIS countries, which is consistent with a Russian-speaking operation (moderate confidence).

Model. A closed operation with no visible affiliate programme, and no ransomware-as-a-service recruitment.

Scale. Sources lists 154 victim records, first tracked 6 May 2025. After removing duplicate, variant and redacted placeholder records, the true number of distinct organisations is closer to 130–140. As of mid-September the leak site itself listed 108 entities, not all of them law firms.

Growth of law-firm listings. Law-firm listings rose from 38 in April to 48 by 29 June and 64 by 21 August.

Operational Characteristics

Speed. In many incidents the whole sequence, from first contact to theft and extortion, happens within a single business day. Data search, staging and theft has been observed starting in under an hour.

Extortion timing. The first extortion email typically arrives within 30 minutes of the attacker leaving the network and gives victims three days to respond.

Harassment. The group also phones employees and clients of victims to pressure the firm into negotiating.

Hard bargaining. The group says it will walk away from large offers and re-attack non-payers. It uses short "3 hour" final warnings, and in one case removed a listing for an hour as a last chance.

Reliability of payment. Earlier reporting says the group uses Bitcoin with a unique wallet per victim, and that after payment it has sometimes gone silent without proof of deletion. Treat assurances of deletion with caution.

Victimology

Geographical Distribution

The group has primarily targeted organizations in the United States, accounting for 119 victims, followed by Germany with 2 victims and Canada with 2 victims. The remaining 31 victims are unattributed by country.

Sector Targeting

Law firms are the group's core target because they hold privileged material, personal data on clients and litigants, and are assessed to be more likely to pay quietly. Accounting firms are also targeted because they hold similar client financial data.

Notable Victims (2026)

Victim	Key facts
Wood Smith Henning & Berman	Demanded $1.8 million for 3.6 GB. The firm countered far lower, and the data was posted.
Marshall Dennehey	Listing states the firm offered $100,000 to keep data unpublished.
Troutman Pepper Locke	A prior physical intrusion in April 2025 (by the group's account, 4.8 GB), then a second attack and leak in August 2026 that reportedly included tens of thousands of SSNs. The listing itself says "2nd time we attacked them in a year".
Greenberg Traurig	The group says it first gained access on 13 August via a corporate iPad, with five people infected, and stayed undetected until the firm noticed on 26 August. A Vermont breach notice on 8 September confirmed SSNs were exposed. Two proposed class actions are pending in federal court in Manhattan. Estimates of scale vary: roughly 126,000 SSNs allegedly surfaced, and a complaint alleges 256,654 records.
Hogan Lovells Cadwalader	Per the group: access on 12 August, 24 hours inside, over 50 GB taken, a demand of at least $20 million against offers reaching $5.34 million, and a second attack on 23 September after talks failed. The firm did not respond to press inquiries, so this remains unconfirmed.
Orrick, Jones Day, Mayer Brown, Holland & Knight, Katten, Cozen O'Connor, Clark Hill	Listed in 2026, none confirmed publicly as of this report.

Data types exposed include privileged and confidential legal documents, SSNs, passports and driver's licences, W-2/W-9/1099 tax forms, medical records, and datasets on class-action litigants. The group also sorts leaked files into folders labelled by sensitivity to make them easier to browse.

Corroboration. Only some victims have confirmed incidents (Troutman and Greenberg Traurig via regulatory notices). Researchers who reviewed several tranches found no evidence the group has leaked fabricated data.

Data Leak Site (DLS)

Clearnet, not Tor:

The site is hosted on business-data-leaks[.]com. Researchers assess the clearnet choice as deliberate: it lets victims and the public view leaks without a Tor browser and amplifies reputational pressure. Some feeds wrongly describe it as a dark-web or onion site.

Branding and design:

The group branded itself "LeakedData" in December 2024, and the site keeps that name. Each listing shows the victim's revenue and a running count of downloads of the stolen data. Older entries in the tracker show revenue, "status: leaked", a download link, and download counts in the 150–170 range. Listings for older victims cluster around 13 December 2024, which appears to be the site's launch batch.

Anti-scraping and hosting:

Download links use a generated token that redirects to a victim folder on a second domain (ep6pheij[.]com), so the index page does not expose folder URLs directly. Both domains sit behind a fast-flux network of residential and mobile IPs across 18 countries and 22 ISPs, rotating every 2–3 minutes, with 50–60% pool overlap between the two domains. The nodes are compromised consumer devices, not hosting providers. Some IPs in the pool were previously mapped to carding-shop and carding-forum domains. A second leak brand, "Spy Corporate" (spycorp[.]pro), emerged in May 2026 on the same infrastructure.

New pressure mechanism (August 2026):

From 12 August the tracker records 26 "redacted entries" with a partially masked victim name and the text "full company name pending disclosure (FULL DATA TIMER active)". These are anchored under the site's /about page. Several appear to resolve later into named listings by matching initials, with a lag of roughly 6 to 27 days (for example Holland & Knight, Katten, Cozen O'Connor and Hogan Lovells). This is my inference from the initials and dates.

Contact model:

The group says it publishes no contact details and cannot be reached unless it makes first contact, so individuals whose data is leaked cannot ask for removal.

Availability:

The tracker records a 55.6% 30-day average uptime and the latest check showed the site unavailable. Some ISPs filter or block it.

Ransom Note

The ransom note is delivered by email, is unbranded, and carries a subject naming the victim and claiming lost client data. It says the group has been in the network for weeks, attaches screenshots as proof, offers a file tree on reply, and promises deletion, video evidence of deletion, and security advice on how it got in. It warns of contact with employees, partners and clients, lawsuits and regulatory fines, and gives three days to start talking. Negotiations then move to a chat, and two negotiation transcripts are archived by trackers (February and March 2026). The group typically opens with very high demands and has publicly claimed to have walked away from at least $16.8 million in rejected offers across listings.

Technical Analysis

Initial Access

Callback phishing (older). Emails pretending to charge a small subscription fee told victims to call a number to cancel, and the caller then sent a remote-access link.

Help-desk impersonation (since about March 2025). The group sends benign invoice-themed emails without links or attachments, then phones employees posing as internal IT, using names and numbers harvested from public websites. Callers often use pretexts such as data migration or a security issue.

Physical intrusion (spring 2026 advisory). An operative visits the office as "IT", says a device must be imaged or backed up, and connects a USB or external drive to copy data.

Other. One victim account involved a compromised corporate iPad, and the group says it used a "new set of tools" against a legacy network. Neither is described in detail.

Execution, Persistence and Tooling

Victims are directed into screen-sharing sessions (Zoom, Teams, Quick Assist, Terminal Services) and then to install AnyDesk, Bomgar, Zoho Assist or SuperOps. Installation links and commands are sent via a self-destructing note service, and one intrusion used a curl one-liner to silently install an MSI. Other tools named in advisories include RustDesk, Syncro, Splashtop and Atera. Use of these tools should not be treated as malicious without evidence of SRG direction. Persistence is limited, with scheduled tasks and registry run keys reported.

Discovery, Collection and Exfiltration

The group pivots from compromised personal devices into virtual desktops (Windows 365 or Citrix), enumerates OneDrive and mapped drives, and uses keyword searches in a document-management system to find tax files, audit records, client agreements and SSNs. Data is staged in the Downloads or Roaming folders.

Exfiltration is pragmatic: portable WinSCP or Rclone, drag-and-drop to consumer cloud accounts (sometimes with folders renamed to mimic the victim), or emailing archives to external addresses. In one case, 1.7 GB went from OneDrive to Google Drive and a further 14.4 GB via WinSCP. Rclone may be hidden or renamed, and the FBI recommends blocking port 22 where possible.

Infrastructure

Earlier analysis identified about 90 associated domains, call-centre-style VoIP numbers, and historical exfiltration servers in the 192.236.128.0/17 range. Phishing domains follow patterns such as organisation-name plus "itdesk", "it" or "helpdesk".

MITRE ATT&CK TTPs

Tactic	Techniques
Initial Access	T1566 (callback phishing), T1566.004 (voice phishing), T1133
Execution	T1204.002 (user execution), T1219 (remote access software), T1059.001/.003, T1569.002
Persistence	T1053.005, T1547.001
Defense Evasion	T1036.005 (renamed tools), T1553.002 (signed legitimate binaries), T1562.001, T1070.001
Credential Access	T1078, T1003.001/.002
Discovery	T1083, T1135, T1046
Lateral Movement	T1021.001, T1021.004
Collection	T1005, T1530, T1560
Command & Control	T1572
Exfiltration	T1567.002, T1052.001, T1020
Impact	T1657 (financial theft); T1486 historical only (2022)

Indicators of Compromise (IOCs)

Leak-site and infrastructure domains:

business-data-leaks[.]com, ep6pheij[.]com, spycorp[.]pro, heopldenticalderr[.]org, hefirealde[.]org, digoprotergonde[.]org, mywebb[.]at

Historical/campaign IPs:

192.236.147.131, 192.236.147.138, 193.141.60.212, 192.236.154.158, 192.236.146.173, 174.169.162.62, 64.94.84.97

Mitigations & Recommendations

1. Help Desk Verification

Publish how IT contacts staff and require call-back verification; train employees to recognize invoice-then-call and help-desk impersonation techniques.

Require independent verification before allowing remote-access software to be installed or granting access to internal systems.

Monitor authentication and user behavior for anomalies, including unusual login locations, access times, and access patterns using XTron AI.

2. RMM and Screen-Share Control

Maintain an allowlist of approved remote monitoring and management (RMM) and screen-sharing tools, and block unauthorized installers and portable executables.

Disable Quick Assist and other remote-support functionality where not required.

Enhance endpoint visibility and behavioral threat detection using CyberXTron ThreatBolt.

Monitor for suspicious command execution, scripting activity, and unauthorized remote-access software.

3. Physical Security

Log and verify visitor identities and require documented work orders for technicians and service personnel.

Escort all external service staff while they are inside sensitive areas.

Disable USB mass-storage devices on sensitive endpoints and monitor for unauthorized removable-media activity.

4. Egress and Exfiltration Monitoring

Alert on the use of tools such as WinSCP and Rclone, connections to external systems over port 22, and uploads to consumer cloud-storage services.

Monitor outbound traffic for large or unusual data transfers and investigate unexpected data movement from document-management and cloud-storage platforms.

Improve network visibility and investigation capabilities using CyberXTron MCP.

5. Data-Access Monitoring

Monitor for unusual keyword-search activity and mass downloads across document-management systems, SharePoint, and mail platforms.

Alert on abnormal access to sensitive client records, SSNs, identity documents, tax records, and other high-value data.

Use XTron AI to assist with identifying anomalous access behavior and prioritizing suspicious activity.

6. Remote Access and BYOD

Restrict virtual desktop, VPN, and other remote-access services to managed and authorized devices.

Require MFA step-up authentication for sensitive systems and unusual access attempts.

Continuously discover and monitor externally exposed remote-access infrastructure, shadow IT, and attack-surface risks using CyberXTron ShadowSpot.

7. Data Minimisation

Discourage the storage of personal or unnecessary sensitive files on work devices.

Reduce retention of SSNs, identity documents, passports, and other sensitive client information where operationally possible.

8. Extortion Readiness

Prepare dedicated legal, client-notification, and regulatory response playbooks for data-extortion incidents operating on short response timelines.

Continuously monitor leak sites and underground sources for indications that organizational or client data has been exposed using CyberXTron DarkFlash.

9. Post-Incident Hardening

Because the group has re-attacked organizations, conduct follow-up threat hunting for lingering RMM agents, unauthorized remote-access software, and persistence mechanisms.

Rotate compromised credentials and review endpoint, identity, mobile-device, and device-management configurations.

Enhance behavioral detection and investigation across endpoints using CyberXTron ThreatBolt.

10. External Exposure and Leak Monitoring

Continuously monitor the group's leak site and redacted listings for your organization and its clients.

Track unauthorized publication of organizational data, credentials, and sensitive information across leak sites and underground sources using CyberXTron DarkFlash.

Monitor for misuse of organizational branding, domains, and leaked assets using CyberXTron BrandSafe.

Conclusion

Silent Ransom Group shows that a data-only extortion model with minimal malware can be as damaging as ransomware, especially against firms that hold highly confidential client data. Its tradecraft is low-tech but effective, and it is expanding: physical intrusions, re-attacks, redacted "timer" listings, resilient fast-flux hosting and demands in the millions. There has been no evidence of arrests or infrastructure takedown. Defences should focus on the human and physical entry points, remote-access control, and detection of bulk data movement rather than encryption behaviour.

Silent Ransom Group and Its Ransomware Operations