SILENTRANSOMGROUP: 3 New Victim Postings on Dark Web Leak Site — US Professional Services Targeting Analysis & Detection Engineering

Classification: TLP:CLEAR | Report Date: 2026-08-21 | Analyst: Security Arsenal Dark Side Intelligence Team | Source: ransomware.live .onion leak site monitoring, CISA KEV

1. Executive Summary

Continuous monitoring of SILENTRANSOMGROUP's .onion leak infrastructure confirms three new victim postings in a 72-hour window (2026-08-18 through 2026-08-20), including Troutman Pepper Locke, a large US professional services / legal firm. The remaining two postings are partially redacted on the leak site (D... and T... P... L...), a common pattern when gangs stagger disclosure to maximize negotiation leverage.

Three observations matter for defenders:

1. US-centric targeting continues. Every confirmed attribution in this window is US-based.
2. Professional services / legal is the visible sector. Legal firms hold privileged client data, M&A material, and litigation strategy — high-leverage extortion content.
3. The disclosure cadence (2 postings same-day, 1 two days later) suggests an active pipeline, not a cleanup of old intrusions. Expect additional postings in the next 7–14 days.

2. Threat Actor Profile — SILENTRANSOMGROUP

Analyst caveat: SILENTRANSOMGROUP is a low-volume operation. Public reporting on this actor is thin, and confidence on tradecraft below is assessed at moderate unless noted. Where the group's specific TTPs are unconfirmed, we flag the assessment as inferred from behavioral patterns common to similarly-sized crews.

3. Current Campaign Analysis

3.1 Victim Breakdown (This Window)

Analytic note: The redacted entry T... P... L... posted the same day as Troutman Pepper Locke is almost certainly a duplicate/placeholder entry for the same victim — gangs often post a teaser entry and a full entry simultaneously. The genuinely distinct second victim (D...) remains unnamed pending negotiation.

3.2 Sector Targeting

The only unredacted sector in this window is professional services / legal. This fits a broader 2026 pattern in which mid-tier crews pivot toward law firms, accounting practices, and consultancies because:

• They aggregate sensitive data for hundreds of downstream clients (one breach = many extortion angles, including third-party pressure).
• Billable-hour business models create extreme downtime sensitivity, shortening time-to-payment.
• Security maturity typically lags regulated industries like finance and healthcare.

3.3 Geographic Concentration

Confirmed targeting is United States only in this window. No evidence of geographic diversification yet.

3.4 Victim Profile

Troutman Pepper Locke is an AmLaw-scale firm (1,000+ attorneys/staff, revenue in the hundreds of millions USD). If representative, SILENTRANSOMGROUP is punching at large-mid-market to enterprise victims rather than SMB spray-and-pray — consistent with deliberate intrusion operations, likely via edge exploitation or purchased access rather than mass phishing.

3.5 Posting Frequency / Escalation

• 2026-08-18: two postings (same-day burst)
• 2026-08-20: one posting

A burst-then-trickle cadence typically indicates: (a) one intrusion campaign reaching leak stage in waves, or (b) a negotiation stalling in public. Watch for the D... entry to be unredacted within 5–7 days — that is the gang's standard escalation move.

3.6 Initial Access Vector Hypothesis — KEV Correlation

We cannot yet confirm which CVE gained entry for these specific victims. However, the following KEV-listed vulnerabilities are confirmed ransomware-associated and represent the most probable ingress set for a crew with this profile. Patch/verify all of them regardless of attribution:

Priority verification: Check Point gateways, ScreenConnect instances (including shadow/MSP-deployed ones), and on-prem Exchange. These three close the most likely intrusion path for this campaign.

4. Detection Engineering

4.1 Sigma Rules

The following rules target the kill chain assessed for this campaign: edge/RMM ingress → lateral movement → exfil staging → encryption prep. Tune thresholds to your environment.

---
title: ScreenConnect or Unauthorized RMM Execution — Pre-Ransomware Ingress
id: 9f2c1a7e-5b31-4c6d-9a01-srg0001
status: experimental
description: Detects execution of ConnectWise ScreenConnect or other RMM tooling frequently abused for ransomware initial access (CVE-2024-1708 exploitation and follow-on use). Alert on any RMM binary not on your approved allowlist.
author: Security Arsenal Dark Side Intel
date: 2026/08/21
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\anydesk.exe'
      - '\TeamViewer.exe'
      - '\splashtop.exe'
      - '\atera_agent.exe'
      - '\ninjarmm.exe'
  selection_cli:
    CommandLine|contains:
      - 'relay?e=Access'
      - 'instance='
      - '/install'
  filter_known_good:
    Image|startswith:
      - 'C:\Program Files\Approved-RMM\'
  condition: (selection_img or selection_cli) and not filter_known_good
falsepositives:
  - Legitimate IT helpdesk RMM sessions — maintain a strict allowlist of approved RMM publishers and hashes
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1219
---
title: Lateral Movement via PsExec-Style Service Creation or WMI Remote Process
id: 9f2c1a7e-5b31-4c6d-9a02-srg0002
status: experimental
description: Detects remote service creation (PsExec-like) and WMI remote process spawn — the two most common lateral movement primitives in small-crew ransomware operations prior to encryption.
author: Security Arsenal Dark Side Intel
date: 2026/08/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
      - '\remcom.exe'
  selection_wmi_child:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: selection_psexec or selection_wmi_child
falsepositives:
  - SCCM/Intune software deployment
  - Vulnerability scanners (Tenable, Qualys) — filter scanner service accounts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: Pre-Encryption Staging — Shadow Copy Deletion or Mass Archive Creation
id: 9f2c1a7e-5b31-4c6d-9a03-srg0003
status: experimental
description: Detects Volume Shadow Copy deletion and mass compression utilities (7z/RAR to temp/staging dirs) — near-universal T-minus indicators in the 1-24 hours before ransomware detonation, including data staging for double extortion.
author: Security Arsenal Dark Side Intel
date: 2026/08/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - CommandLine|contains|all:
        - 'vssadmin'
        - 'delete'
        - 'shadows'
    - CommandLine|contains|all:
        - 'wmic'
        - 'shadowcopy'
        - 'delete'
    - CommandLine|contains|all:
        - 'bcdedit'
        - 'recoveryenabled'
        - 'no'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a -t'
      - ' -p'
      - '\Temp\'
      - '\ProgramData\'
  condition: selection_vss or selection_archive
falsepositives:
  - Backup software performing VSS maintenance — exclude backup service accounts and known backup binaries
  - Legitimate admin archiving — correlate with user and host context
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1074

4.2 KQL — Microsoft Sentinel Hunt: Pre-Ransomware Staging & Lateral Movement Chain

This query correlates, per device over a 6-hour window, the sequence: RMM/suspicious process execution → remote logon from a new source → archive/VSS staging activity. A hit on the full chain is a T-minus alert, not a hunt result.

// SILENTRANSOMGROUP-style pre-encryption chain hunt
// Correlates RMM execution -> anomalous remote logon -> staging indicators per device
let lookback = 7d;
let window = 6h;
let rmm_procs = dynamic(["ScreenConnect", "AnyDesk", "TeamViewer", "splashtop", "atera", "ninjarmm", "psexec", "paexec", "remcom"]);
let staging_procs = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe", "vssadmin.exe", "bcdedit.exe", "wbadmin.exe"]);
let RMMHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any (rmm_procs) or ProcessCommandLine has_any (rmm_procs)
    | summarize RMMFirstSeen=min(TimeGenerated), RMMCount=count(), RMMProcs=make_set(FileName) by DeviceName, bin(TimeGenerated, window);
let RemoteLogons =
    DeviceLogonEvents
    | where TimeGenerated > ago(lookback)
    | where LogonType in ("RemoteInteractive", "Network")
    | where InitiatingProcessRemoteIP !startswith "10." and InitiatingProcessRemoteIP !startswith "192.168." // flag external/VPN-source logons; tune to your ranges
    | summarize RemoteLogonCount=count(), SourceIPs=make_set(InitiatingProcessRemoteIP) by DeviceName, bin(TimeGenerated, window);
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (staging_procs)
    | where ProcessCommandLine has_any ("delete", "shadows", "recoveryenabled", " a -t", "-p", "\\Temp\\", "\\ProgramData\\")
    | summarize StagingFirstSeen=min(TimeGenerated), StagingCmds=make_set(ProcessCommandLine, 5) by DeviceName, bin(TimeGenerated, window);
RMMHits
| join kind=inner RemoteLogons on DeviceName, TimeGenerated
| join kind=inner Staging on DeviceName, TimeGenerated
| project DeviceName, TimeGenerated, RMMFirstSeen, RMMProcs, SourceIPs, StagingFirstSeen, StagingCmds
| order by TimeGenerated desc;

Tune the IP filtering to your VPN egress ranges — the intent is to catch RMM execution paired with a logon from infrastructure that shouldn't be administering that host, followed by compression/VSS activity. Any single-stage hit on the Staging branch alone (especially vssadmin delete shadows outside backup windows) should page on-call.

4.3 PowerShell — Rapid Triage & Hardening Script

Run on file servers, domain controllers, and any host flagged by the rules above. Read-only triage plus one optional containment toggle.

# SRG-Triage.ps1 — Rapid pre-ransomware triage for suspected SILENTRANSOMGROUP-style intrusion
# Run elevated. Read-only unless -DisableRDP is specified.
param([switch]$DisableRDP)

$out = "$env:TEMP\SRG-Triage-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
"=== SRG TRIAGE $(Get-Date) on $env:COMPUTERNAME ===" | Out-File $out

"`n[1] RDP exposure (3389 listening + NLA status):" | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Format-Table | Out-String | Out-File $out -Append
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
"NLA enabled: $nla (1 = good, 0 = CRITICAL FINDING)" | Out-File $out -Append

"`n[2] Scheduled tasks created in last 7 days (persistence check):" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
  $i = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$i.LastRunTime }
} | Where-Object { $_.Path -notlike '\Microsoft*' } | Format-Table -Auto | Out-String | Out-File $out -Append

"`n[3] RMM / lateral movement binaries present:" | Out-File $out -Append
$paths = @("$env:ProgramFiles", "${env:ProgramFiles(x86)}", "$env:ProgramData", "$env:TEMP")
$names = @("psexec*","psexesvc*","paexec*","remcom*","screenconnect*","anydesk*","teamviewer*","atera*","ninjarmm*","7z.exe","rar.exe")
foreach ($p in $paths) { foreach ($n in $names) {
  Get-ChildItem -Path $p -Filter $n -Recurse -ErrorAction SilentlyContinue -Depth 3 |
    Select-Object FullName, CreationTime, LastWriteTime } } |
  Format-Table -Auto | Out-String | Out-File $out -Append

"`n[4] Volume Shadow Copies (missing shadows on a server = red alert):" | Out-File $out -Append
vssadmin list shadows 2>&1 | Out-File $out -Append

"`n[5] Recent suspicious network beacons (outbound 443 to rare destinations, last 100):" | Out-File $out -Append
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue |
  Group-Object RemoteAddress | Sort-Object Count -Descending | Select-Object -First 100 Name, Count |
  Format-Table -Auto | Out-String | Out-File $out -Append

if ($DisableRDP) {
  Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 1
  Disable-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue
  "`n[ACTION] RDP DISABLED on this host." | Out-File $out -Append
}

"`nTriage output written to $out" 

5. Incident Response Priorities — SILENTRANSOMGROUP Playbook

5.1 T-Minus Detection Checklist (Before Encryption Fires)

In descending order of urgency — if you see any two of these co-occurring on a server, treat as active pre-detonation:

1. vssadmin delete shadows / bcdedit ... recoveryenabled no outside backup windows
2. New 7z/RAR archives in C:\ProgramData\, C:\Users\Public\, or staging dirs with -p (password) flags
3. RMM binary present that your IT team did not deploy (ScreenConnect especially — verify against MSP records)
4. PSExec-style service creation (PSEXESVC) or WmiPrvSE.exe spawning shells across hosts
5. New local admin accounts or unexpected additions to Domain Admins / local Administrators
6. Large sustained outbound transfers to consumer cloud storage (MEGA, pCloud, file.io, temp-share services)
7. Scheduled tasks or services named to mimic legitimate software, created within the last 7 days

5.2 Assets This Profile of Actor Prioritizes for Exfiltration

Given the professional-services/legal targeting, assume priority on:

• Document management systems (iManage, NetDocuments) and matter/client folders
• Email archives of partners and the general counsel function
• Finance/billing systems (client lists, engagement terms — extortion leverage)
• HR records and anything with PII for regulatory-pressure leverage
• Backup infrastructure credentials — expect an attempt on Veeam/Commvault before detonation

5.3 Containment — Ordered by Urgency

1. Isolate, don't power off affected hosts (preserve memory for forensics) — VLAN quarantine first.
2. Disable the ingress path: block/disable RMM tooling enterprise-wide at the EDR and firewall layer; force-reset VPN gateway credentials and review IKEv1 config if Check Point is in scope.
3. Credential reset in rings: domain admins → service accounts → all users with recent interactive logons on touched hosts. Assume DCSync if a DC was reached.
4. Verify backup integrity and offline copies before announcing internally — attackers time detonation to discovery.
5. Do not engage the leak site or negotiation portal from corporate infrastructure; route through IR counsel and threat intel channels.

6. Hardening Recommendations

Immediate (24 hours)

• Patch/verify: Check Point Security Gateway (CVE-2026-50751), ConnectWise ScreenConnect (CVE-2024-1708), on-prem Exchange (CVE-2023-21529), Windows link-following privesc (CVE-2025-60710). Audit Nx Console versions in dev environments (CVE-2026-48027).
• RMM allowlisting: Block all remote access tools except an explicitly approved, version-pinned list. Alert on any deviation — this single control breaks the most common ingress for this victim profile.
• Disable IKEv1 on Check Point gateways where feasible; audit VPN local accounts for credential-stuffing exposure and enforce MFA on all remote access.
• Deploy the Sigma rules above and the Sentinel hunt; page on vssadmin delete shadows anywhere outside approved backup tooling.
• Legal firms specifically: brief DMS administrators; enable enhanced audit logging on iManage/NetDocuments bulk exports.

Short-Term (2 weeks)

• Tiered administration: separate workstations/accounts for admin tiers; no DA logons on member servers or endpoints.
• Egress filtering: deny outbound to unsanctioned file-sharing/cloud storage domains; alert on >1GB uploads to novel destinations.
• Immutable/offline backups with restore testing on a fixed cadence; isolate backup control plane credentials from AD.
• Attack surface reduction: audit for shadow RMM, forgotten ScreenConnect/MSP agents, and externally exposed RDP — move RDP behind VPN + MFA or disable it.
• Detection-as-code: promote the Sigma rules and KQL query into your production pipeline with automated tuning reviews.

7. Intelligence Gaps & Collection Plan

• Monitor the leak site for unredaction of the D... entry (expected within 5–7 days) and any new burst postings.
• No confirmed sample of SILENTRANSOMGROUP's encryptor is in public malware repositories at time of writing; if your org is impacted, prioritize memory capture before remediation so a sample can be recovered.
• Attribution of initial access for the Troutman Pepper Locke intrusion remains open; we will update this brief if public filings or notifications confirm the vector.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub