Silent Ransom Group Targets US Law Firms in Data Theft Extortion Campaign
By
Jai Vijayan
Toasted golden, schmeared with insight. Top of the rack.
Summary
A financially motivated threat group tracked as UNC3753 and associated with the Silent Ransom group is targeting US law firms, professional services, and financial services companies in a data theft extortion campaign. The group uses a combination of phishing, voice impersonation (vishing), IT impersonation, legitimate remote access tools, and even in-person office intrusions to steal sensitive data and extort victims under threat of public disclosure. Mandiant attributed the activity to this group, noting dozens of targeted attacks between January and May 2026.
Key quotes
· 3 pulledA financially motivated threat group is targeting US legal, professional and financial services firms in a data theft extortion campaign using a combination of phishing, voice impersonation tactics, and legitimate remote access tools.
Google's Mandiant division attributed the activity to UNC3753, a threat cluster associated with the Silent Ransom group, which is known for stealing high-value data from victims and then extorting ransoms from them under the threat of public disclosure.
Between January and May 2026, the group...
You might also wanna read
Investigating the Identity Behind the Ransomware Group 'The Gentlemen'
A cybercrime group called The Gentlemen has become the second most active ransomware gang by victim count, using an aggressive recruitment s
Google Confirms Data Breach in Salesforce CRM Theft Campaign by ShinyHunters
Google has become the latest victim of a data breach in a series of Salesforce CRM data theft attacks orchestrated by the ShinyHunters extor
bleepingcomputer.com·10mo ago
Checkout.com Responds to Cyber Extortion Attempt Targeting Legacy System
Checkout.com experienced a cyber extortion attempt by the criminal group 'ShinyHunters' who gained unauthorized access to a legacy third-par
checkout.com·7mo ago
Pro-Iran hacktivist group launches DDoS attack on Canonical, demands payment
Canonical, the company behind Ubuntu Linux, is experiencing a sustained DDoS attack from a pro-Iranian hacktivist group called 313 Team. The
The Register·1mo ago
Hacking Group Threatens Google with Data Leak Unless Employees Are Fired
A hacking group has issued an ultimatum to Google, threatening to leak company databases unless Google fires two specific employees and susp
newsweek.com·9mo ago
German Authorities Identify Russian Hacker "UNKN" as Leader of REvil and GandCrab Ransomware Groups
German authorities have identified and publicly named Daniil Maksimovich Shchukin, a 31-year-old Russian national, as the previously elusive