Silent Ransom Group's $207M Vishing Extortion Campaign Against Law Firms — Detection and Hardening Guide

For the better part of a decade, the ransomware defense conversation has centered on encryption: stopping payload execution, detecting mass file modification, protecting backups. Silent Ransom Group (SRG) just demonstrated — at industrial scale — that none of that matters if your attacker never deploys malware at all.

According to reporting this week, SRG allegedly extorted $207 million from 27 law firms in just six months — an average of roughly $7.7 million per victim — using phone calls and social engineering as the entire intrusion mechanism. No exploits. No ransomware binary. No encrypted files. Just convincing voices, abused trust, and the theft of data that law firms cannot afford to see published: privileged client communications, litigation strategy, M&A details, and personally identifiable information covered by attorney-client privilege.

This is not a novel technique — SRG (also tracked in overlapping reporting as Luna Moth and tied to the broader ChatGPT-spoofing callback phishing wave) has operated this way since at least 2022. What is new is the proven economics. $207 million in six months tells every criminal crew watching that pure social engineering against professional services firms has a higher ROI than running a ransomware operation. Your EDR stack is irrelevant against an attacker who logs in legitimately. That is the uncomfortable reality defenders need to internalize now.

Technical Analysis: The Attack Chain

Why Law Firms

Law firms are a deliberately chosen target class, and the targeting logic is sound:

• Extortion leverage: Privileged communications and client data carry catastrophic confidentiality obligations. A firm's duty to its clients creates enormous pressure to pay quietly.
• High-value helpdesk interactions: Firms run lean IT departments supporting attorneys who are time-pressured, mobile, and not security-trained to SOC standards.
• Abundant reconnaissance material: Attorney bios, practice areas, case announcements, and LinkedIn provide everything needed to impersonate IT staff, vendors, or opposing counsel's technical teams.

The Intrusion Mechanics

SRG's documented playbook replaces the exploit-and-payload chain with a vishing-driven initial access chain:

1. Callback phishing lure: The victim receives an email (often an invoice-themed message for a subscription or service) that contains no malicious link or attachment — just a phone number to call "to dispute the charge." This evades virtually all email security tooling because there is nothing technically malicious in the message.
2. The phone call: When the victim calls, a convincing operator walks them through "canceling the charge," which requires installing a remote management and monitoring (RMM) tool — historically Zoho Assist, AnyDesk, TeamViewer, ScreenConnect (ConnectWise Control), Syncro, or Splashtop. These are legitimate, signed, widely used applications. Most application control policies permit them.
3. Legitimate access, illegitimate operator: Once the RMM session is established, the attacker operates inside a trusted, encrypted support channel. EDR sees a signed binary talking to its own vendor infrastructure. From here they harvest credentials, access email and file shares, and stage data for exfiltration.
4. Data theft, no encryption: Stolen data is exfiltrated — commonly via Rclone, WinSCP, or the RMM tool's own file transfer capability — to attacker-controlled cloud storage.
5. Extortion: Days or weeks later, the firm receives the demand. The threat is publication, not decryption. There is nothing to restore because nothing was destroyed.

Why Your Current Controls Likely Miss This

Every stage of this chain lives inside trusted channels:

• No malicious email artifact → secure email gateways have nothing to block
• User-initiated install of signed software → application whitelisting permits it
• Signed RMM binary beaconing to vendor domains → network detection sees normal SaaS traffic
• File transfer via legitimate tools → DLP tuned for malware behaviors sees "administrative" activity

The observable signals exist — but they are behavioral, not signature-based. That is where detection engineering earns its keep.

Exploitation Status

• In the wild: Confirmed, at scale — 27 victims and $207M in claimed extortion over six months.
• CVEs: None. There is no vulnerability to patch. This is a procedure, not a product flaw (MITRE ATT&CK: T1656 Impersonation, T1566 Phishing, T1204 User Execution, T1219 Remote Access Software, T1567 Exfiltration Over Web Service, T1657 Financial Theft).
• CISA KEV: Not applicable — no CVE exists to catalog.

Detection & Response

The detection strategy rests on three pillars: unauthorized RMM tooling, anomalous exfiltration tooling, and identity signals that corroborate vishing-driven access. Tune allowlists to your approved remote support stack first — the rules below assume your organization has an approved RMM list (most should have exactly one or two approved tools).

Sigma Rules

---
title: Unauthorized RMM Tool Execution - Silent Ransom Group TTP
id: 9c4e2a17-3b8f-4d21-a6e5-7f0c1d9b2e48
status: experimental
description: Detects execution of remote access tools commonly abused by Silent Ransom Group / Luna Moth callback phishing campaigns. Tune the filter to your approved RMM stack; any RMM tool outside that list on an endpoint is an incident until proven otherwise.
references:
  - https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/17
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\strwinclt.exe'
      - '\SplashtopStreamer.exe'
      - '\SRStreamer.exe'
      - '\ZohoMeeting.exe'
      - '\ZohoAssist.exe'
      - '\Syncro.exe'
      - '\SyncroLive.exe'
      - '\AteraAgent.exe'
      - '\dwagent.exe'
  filter_approved:
    Image|contains:
      - 'C:\Program Files\YourApprovedRMM\'
  condition: selection_img and not filter_approved
falsepositives:
  - Approved remote support sessions if the filter list is incomplete
  - Legacy tools present in the environment that should be removed
level: high
---
title: Data Exfiltration Utility Execution - Rclone WinSCP
id: 2f7b9d41-6e3a-4c58-b1d9-8a4f6e2c7d15
status: experimental
description: Detects execution of Rclone or WinSCP with cloud storage or transfer arguments, a hallmark of SRG/Luna Moth data theft operations. Rclone has almost no legitimate use in a typical law firm endpoint population.
references:
  - https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/02/17
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--config'
  selection_winscp:
    Image|endswith:
      - '\winscp.exe'
      - '\WinSCP.com'
    CommandLine|contains:
      - '/script'
      - 'sftp://'
      - 'ftp://'
  condition: 1 of selection_*
falsepositives:
  - Managed backup solutions using rclone (rare; verify against approved software inventory)
  - IT staff SFTP automation
level: high
---
title: Portable Executable RMM Dropped in User-Writable Path
id: 61c8a3f2-7d4b-4e96-9c21-5b3a8e0f4d72
status: experimental
description: Detects remote access executables written to user-writable directories, consistent with a victim being walked through a browser download during a callback phishing phone call rather than a managed software deployment.
references:
  - https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html
  - https://attack.mitre.org/techniques/T1656/
author: Security Arsenal
date: 2026/02/17
tags:
  - attack.initial_access
  - attack.t1656
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  selection_name:
    TargetFilename|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewerQS.exe'
      - '\TeamViewer_Setup.exe'
      - '\ScreenConnect.ClientSetup.exe'
      - '\Splashtop_Streamer.exe'
      - '\ZohoAssistSetup.exe'
      - '\ZA_connect.exe'
      - '\ConnectWiseControl.ClientSetup.exe'
  condition: all of selection_*
falsepositives:
  - Users installing approved support tools without IT involvement (this itself should be policy-flagged)
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for RMM execution outside your approved list, then correlates with the initiating process to distinguish scripted deployments from user-driven downloads — the vishing signature is an RMM install spawned from a browser or Explorer, not from your software deployment tooling. Update the ApprovedRMM list to match your environment before deploying.

let ApprovedRMM = dynamic(["YourApprovedRMM.exe"]);
let RMMList = dynamic(["AnyDesk.exe","TeamViewer.exe","TeamViewer_Service.exe","ScreenConnect.ClientService.exe","strwinclt.exe","SplashtopStreamer.exe","SRStreamer.exe","ZohoAssist.exe","ZA_connect.exe","Syncro.exe","SyncroLive.exe","AteraAgent.exe","dwagent.exe","rclone.exe","winscp.exe","WinSCP.com"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (RMMList) and not(FileName in~ (ApprovedRMM))
| extend UserDrivenInstall = InitiatingProcessFileName in~ (dynamic(["chrome.exe","msedge.exe","firefox.exe","explorer.exe","outlook.exe"]))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, UserDrivenInstall,
          AccountName, SHA256, ReportId
| order by UserDrivenInstall desc, TimeGenerated desc

Companion query for exfiltration staging — look for large outbound transfers immediately following an unauthorized RMM session on the same device:

let SuspectDevices = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (dynamic(["AnyDesk.exe","ZohoAssist.exe","ZA_connect.exe","strwinclt.exe","rclone.exe"]))
| summarize FirstSeen=min(TimeGenerated) by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where DeviceName in (SuspectDevices)
| join kind=inner SuspectDevices on DeviceName
| where TimeGenerated between (FirstSeen .. FirstSeen + 72h)
| where RemoteUrl has_any ("mega.nz","dropbox.com","transfer.sh","file.io","anonfiles","temp.sh","pcloud.com","sync.com")
   or RemoteUrl has_any ("zoho.com","anydesk.com","teamviewer.com","screenconnect.com")
| summarize Connections=count(), DistinctRemoteIPs=dcount(RemoteIP), FirstConn=min(TimeGenerated), LastConn=max(TimeGenerated)
          by DeviceName, RemoteUrl, RemoteIP
| order by Connections desc

Velociraptor VQL

Use this hunt artifact to sweep the fleet for RMM tooling and exfiltration utilities — both running processes and recently dropped binaries in user-writable paths. Deploy it fleet-wide after any suspected callback phishing report from your helpdesk.

-- Hunt: Unauthorized RMM and exfiltration tooling (SRG / Luna Moth TTPs)
LET rmm_regex = '(anydesk|teamviewer|screenconnect|strwinclt|splashtop|zohoassist|za_connect|syncro|ateraagent|dwagent|rclone|winscp)'

LET running = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Name =~ rmm_regex OR Exe =~ rmm_regex

LET dropped = SELECT FullPath, Size, Mtime, Ctime
  FROM glob(globs=[
    'C:/Users/*/Downloads/*',
    'C:/Users/*/AppData/Local/Temp/*',
    'C:/Users/*/AppData/Roaming/*'
  ])
  WHERE FullPath =~ rmm_regex AND Mtime > now() - 60*60*24*30

LET connections = SELECT Pid, Name, Family, Type, Status,
    Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
    Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
  FROM netstat()
  WHERE Name =~ rmm_regex AND Status =~ 'ESTAB'

SELECT * FROM chain(a=running, b=dropped, c=connections)

Audit and Hardening Script

Run this PowerShell audit across your estate (or via your RMM/Intune) to inventory unauthorized remote access tools and exfiltration utilities. The script reports — it does not auto-remove — because ripping out a tool a business unit legitimately uses creates its own incident.

# Security Arsenal - Unauthorized RMM & Exfil Tool Audit
# Run as administrator. Outputs CSV per host for central collection.

$RMMNames = @(
  'AnyDesk','TeamViewer','ScreenConnect','ConnectWise','Splashtop',
  'Zoho Assist','ZohoAssist','Syncro','Atera','Dameware','rclone','WinSCP'
)

$results = @()

# 1. Installed software registry check (both hives, 32/64-bit)
$regPaths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($path in $regPaths) {
  Get-ItemProperty $path -ErrorAction SilentlyContinue |
    Where-Object { $n = $_.DisplayName; $RMMNames | Where-Object { $n -like "*$_*" } } |
    ForEach-Object {
      $results += [PSCustomObject]@{
        Host = $env:COMPUTERNAME; Source = 'InstalledSoftware'
        Name = $_.DisplayName; Version = $_.DisplayVersion
        Publisher = $_.Publisher; InstallDate = $_.InstallDate
      }
    }
}

# 2. Portable binaries in user-writable paths (vishing-driven installs)
$userPaths = @('C:\Users\*\Downloads','C:\Users\*\AppData\Local\Temp','C:\Users\*\AppData\Roaming')
foreach ($p in $userPaths) {
  Get-ChildItem $p -Recurse -Include '*.exe' -ErrorAction SilentlyContinue |
    Where-Object { $f = $_.Name; $RMMNames | Where-Object { $f -like "*$_*" } } |
    ForEach-Object {
      $results += [PSCustomObject]@{
        Host = $env:COMPUTERNAME; Source = 'PortableBinary'
        Name = $_.Name; Version = $_.VersionInfo.ProductVersion
        Publisher = $_.VersionInfo.CompanyName; InstallDate = $_.CreationTime.ToString('yyyyMMdd')
      }
    }
}

# 3. Running services for persistence check
Get-Service -ErrorAction SilentlyContinue |
  Where-Object { $s = $_.DisplayName; $RMMNames | Where-Object { $s -like "*$_*" } } |
  ForEach-Object {
    $results += [PSCustomObject]@{
      Host = $env:COMPUTERNAME; Source = 'Service'
      Name = $_.DisplayName; Version = ''; Publisher = ''; InstallDate = ''
    }
  }

$results | Export-Csv ".\RMM_Audit_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Output "Audit complete: $($results.Count) findings. Review and validate against approved software list."

Remediation and Hardening

There is no patch for this threat — the fix is architectural and procedural. Prioritize in this order:

1. Establish and Enforce an Approved RMM List (This Week)

• Publish an allowlist of exactly the remote support tools your organization sanctions. Everything else is a policy violation.
• Enforce via AppLocker or WDAC with publisher rules for approved tools and explicit deny rules for known-abused RMM binaries. Microsoft's own recommended driver blocklist and the LOLRMM project (lolrmm.io) provide community-maintained blocklists for this exact purpose.
• Block RMM vendor domains at the DNS/proxy layer for tools not on the approved list — an AnyDesk binary that cannot reach AnyDesk infrastructure is inert.

2. Helpdesk Verification Procedures — The Single Highest-Value Control

SRG's entire model collapses if your helpdesk and your users apply out-of-band verification:

• Helpdesk-initiated remote sessions only: Institute a hard policy that IT will never cold-call a user and ask them to install software or read out a code. Publish this policy to every employee. It gives users a simple, memorable reason to hang up.
• Callback verification: Any inbound call claiming to be IT, a vendor, or a partner must be terminated and re-initiated via the number in the corporate directory.
• MFA number-matching and anti-fatigue: Enable number matching on push-based MFA, and alert on MFA deny/retry storms. Train users that an MFA prompt they did not trigger is an attack in progress, not a glitch to approve away.
• Protect the helpdesk itself: Require identity proofing (voice passphrase, manager callback, or IDV tooling) before password resets or MFA changes — especially for attorneys and partners, who are the highest-value targets.

3. Detect and Contain Data Theft

• Deploy the detections above; treat any unauthorized RMM execution as a Severity 2 incident minimum, not a policy ticket.
• Egress monitoring: alert on sustained outbound transfers to consumer file-sharing and ephemeral transfer domains (mega.nz, transfer.sh, file.io, anonfile variants).
• If an unauthorized session is confirmed: kill the session and the tool, assume credentials used during the session window are compromised, reset them, revoke tokens, and hunt lateral movement from that endpoint for the session duration plus 72 hours.

4. Legal-Firm-Specific Considerations

• Pre-brief your breach counsel and cyber insurance carrier now. Extortion-only events with no encryption still trigger notification obligations in many jurisdictions depending on the data classes stolen — determine your position before the phone rings, not after.
• Matter/case data segmentation: limit the blast radius of any single compromised endpoint. An attorney's workstation should not have unrestricted read access to the entire document management system.
• Tabletop this exact scenario with firm leadership: "We received an extortion demand claiming client files; our systems show no encryption." The decisions about payment, disclosure, and client notification are executive decisions — rehearse them.

5. Reporting and Intelligence

• Report suspected SRG/callback phishing activity to the FBI (IC3.gov) and CISA (report@cisa.gov). Vishing incidents are chronically underreported, which is part of why this group has operated profitably for years.
• Feed helpdesk-reported vishing attempts into your SOC as telemetry — a spike in "someone called claiming to be IT" reports is an early-warning indicator of an active campaign against your organization.

The lesson from $207 million in six months is blunt: identity and process controls are now the perimeter for professional services firms. The encryption-centric ransomware playbook prepared defenders for the wrong fight. This one is won or lost at the helpdesk, in application control policy, and in whether a user hangs up the phone.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub