Classification: TLP:CLEAR | Publication Date: 2026-10-12 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

SILENTRANSOMGROUP: 5 New Leak-Site Listings in 6 Days — Professional Services Sector in the Crosshairs

Executive Summary

Between 2026-10-06 and 2026-10-08, the ransomware operation tracked as SILENTRANSOMGROUP listed five organizations on its dark web leak site. All identifiable listings fall within the Professional Services sector, with the United States as the only confirmed targeted geography. Named organizations include O'Hagan Meyer, Baker McKenzie, Andersen Group Inc., Andersen Group, and one listing partially redacted as "K...". Every listing in this batch is a single-source observation — no second independent crawler has corroborated that the postings exist, and nothing in this data confirms any breach occurred. These are unverified claims by a criminal organization.

Defenders in legal, consulting, and advisory services should treat this as an early-warning signal: a cluster of same-sector, same-week claims is consistent with a deliberate campaign wave rather than opportunistic postings. This briefing translates that signal into detection content and response priorities.

Sourcing & Verification

• 0 of 5 listings were independently observed by a second leak-site crawler; all 5 appear on ransomware.live only and are classified SINGLE-SOURCE.
• Inclusion in this briefing reflects the threat actor's claim and is not confirmation of a breach. A leak-site posting is an accusation by a criminal, not evidence.
• A named organization may dispute the listing, and a denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction, and not every incident is reportable. Neither silence nor denial settles the question. Only the organization or its regulator can confirm an incident.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — SILENTRANSOMGROUP

Aliases & naming: SILENTRANSOMGROUP operates under a single branded identity in current monitoring; no widely attributed alternate aliases are confirmed in our dataset. The naming convention and leak-site cadence suggest a mid-tier operation rather than a top-volume RaaS brand.

Operating model: Posting cadence (5 listings in a 6-day window) and tight sector focus are consistent with a closed-group or small-affiliate model — operators handling intrusion, negotiation, and leak publication in-house rather than franchising at scale.

Extortion approach: Like virtually all modern ransomware crews, SILENTRANSOMGROUP employs double extortion: data is staged and exfiltrated before encryption, then listed on the leak site with escalating publication threats to force payment. Professional services firms are attractive precisely because client confidentiality obligations amplify leak pressure.

Ransom demands: Sector-typical demands for professional services targets of this size profile generally fall in the low-to-mid six figures USD (cryptocurrency-denominated), scaling with perceived revenue and cyber insurance coverage. No demand figures have been published in the observed listings.

Initial access methods (typical for this threat class):

• Spear phishing with malicious attachments or links (macro-enabled documents, HTML smuggling)
• Exploitation of exposed perimeter services — VPN concentrators, firewall management interfaces, remote access gateways
• RDP brute force / credential stuffing against internet-facing remote access
• Abuse of CI/CD and build infrastructure as a software supply-chain pivot

Dwell time: Operators in this tier typically maintain 3–14 days of dwell time between initial access and detonation, using the interval for credential harvesting, lateral movement, and bulk data staging. The pre-encryption window is the defender's best — and often only — opportunity to detect the intrusion.

Current Campaign Analysis

Sector targeting: All four fully identifiable listings are Professional Services — law firms and consulting/advisory entities. O'Hagan Meyer and Baker McKenzie are law firms; Andersen Group Inc. and Andersen Group are listed under Professional Services. One listing ("K...") carries no sector tag in the data. This is not scattergun targeting: the cluster indicates deliberate prioritization of organizations holding privileged client communications, litigation materials, and M&A data — high-leverage extortion content.

Geographic concentration: The United States is the only confirmed country in this batch (Baker McKenzie, US). Three listings carry no confirmed country tag.

Victim profile: The named organizations span a size range from mid-market advisory firms to large international law practices. Professional services firms in this band typically generate $50M–$2B+ in annual revenue, maintain flat-ish internal networks optimized for knowledge sharing, and carry substantial cyber insurance — all factors that make them rational extortion targets.

Posting frequency / escalation: 5 listings across 2026-10-06 through 2026-10-08 — a compressed burst pattern. Burst posting is a known negotiation tactic: operators dump a batch of claims simultaneously to demonstrate pipeline depth and pressure holdouts. Watch for a second wave roughly 7–14 days out if negotiations stall, and for data-sample publications escalating the pressure.

CVE linkage — hypothesis only: We have no evidence tying any specific CVE to any specific named listing. However, SILENTRANSOMGROUP's claimed victim profile (US professional services with large virtualized estates and remote-access-heavy workforces) aligns with the following sector-level exposure items currently on the CISA KEV with confirmed ransomware use. Treat these as prioritized patch targets, not as established intrusion vectors for the named organizations:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): perimeter VPN/auth bypass class — a classic initial access route.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: management-plane compromise enabling lateral reach into segmented networks.
• CVE-2026-59310 — VMware vCenter path traversal: hypervisor-management compromise — the highest-impact target pre-detonation, since vCenter control enables mass VM encryption and shadow-copy destruction at scale.
• CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD compromise enabling signed-payload supply-chain pivots.
• CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply-chain foothold.

Detection Engineering

The following detections target the TTP cluster associated with this threat class: perimeter credential attacks, macro/phishing execution, WMI/PsExec lateral movement, and pre-encryption data staging plus shadow-copy destruction.

---
title: SILENTRANSOMGROUP TTP - Volume Shadow Copy Deletion via vssadmin or wmic
id: 9b2f1c3a-7e4d-4f1a-a5b2-3c9d8e6f1a01
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies, a near-universal pre-encryption step observed in double-extortion ransomware operations targeting virtualized estates.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_img:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
    selection_cmd:
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
    condition: selection_img and selection_cmd
falsepositives:
    - Legitimate backup administrators modifying shadow storage settings
    - System maintenance scripts
references:
    - https://securityarsenal.com/darkside
date: 2026/10/12
modified: 2026/10/12
tags:
    - attack.impact
    - attack.t1490
---
title: SILENTRANSOMGROUP TTP - PsExec or WMI Remote Service Execution for Lateral Movement
id: 1a7d3e92-5c6b-4a08-9f2e-7d4b1c8a3e05
status: experimental
description: Detects remote service creation and WMI-spawned processes consistent with PsExec-style tooling used by ransomware operators for lateral movement and mass payload deployment.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_psexec:
        Image|endswith:
            - '\PSEXESVC.exe'
            - '\PAExec.exe'
            - '\csexec.exe'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    selection_service:
        CommandLine|contains:
            - 'ADMIN$'
            - '\\.\pipe\'
    condition: selection_psexec or selection_wmi or (selection_service and selection_wmi)
falsepositives:
    - Legitimate administrative use of PsExec by IT staff
    - SCCM and enterprise software deployment tools
references:
    - https://securityarsenal.com/darkside
date: 2026/10/12
modified: 2026/10/12
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1569.002
---
title: SILENTRANSOMGROUP TTP - Office Macro Spawning Scripting or Archive Utilities for Staging
id: 4e9c1b7d-2f8a-4d06-b3e5-9a1c7f4d2b09
status: experimental
description: Detects Office applications spawning scripting engines, download cradles, or archive utilities — consistent with phishing-driven initial access and pre-exfiltration data staging.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
level: medium
detection:
    selection_parent:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\outlook.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\7z.exe'
            - '\rar.exe'
            - '\curl.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare legitimate macro-driven automation in finance/legal departments
references:
    - https://securityarsenal.com/darkside
date: 2026/10/12
modified: 2026/10/12
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.collection
    - attack.t1560.001

The Sentinel hunt below surfaces the pre-detonation staging window: burst outbound transfer from servers joined to recently created scheduled tasks or new service installations — the fingerprint of a ransomware operator positioning for mass encryption.

// SILENTRANSOMGROUP-style pre-detonation hunt: new scheduled tasks/services + staging indicators
// Lookback: 14 days to bracket the observed posting window (2026-10-06 to 2026-10-12)
let lookback = 14d;
let NewPersistence =
    union
    (SecurityEvent
        | where TimeGenerated > ago(lookback)
        | where EventID == 4698  // Scheduled task created
        | project TimeGenerated, Computer, Account, TaskName, PersistenceType="ScheduledTask"),
    (SecurityEvent
        | where TimeGenerated > ago(lookback)
        | where EventID == 7045  // New service installed
        | project TimeGenerated, Computer, Account, TaskName=ServiceName, PersistenceType="ServiceInstall");
let SuspiciousStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("rclone.exe","7z.exe","rar.exe","winscp.exe","pscp.exe","curl.exe","megasync.exe")
    | summarize FirstSeen=min(TimeGenerated), CmdLines=make_set(ProcessCommandLine, 5) by DeviceName, FileName;
let ShadowTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows","resize shadowstorage","shadowcopy delete","recoveryenabled no")
    | summarize ShadowEvents=make_set(ProcessCommandLine, 5) by DeviceName;
NewPersistence
| summarize PersistenceEvents=make_set(strcat(PersistenceType, ":", TaskName), 10), FirstPersistence=min(TimeGenerated) by Computer
| join kind=leftouter (SuspiciousStaging) on $left.Computer == $right.DeviceName
| join kind=leftouter (ShadowTamper) on $left.Computer == $right.DeviceName1
| extend RiskScore = (iff(isnotempty(FileName), 2, 0)) + (iff(isnotempty(ShadowEvents), 3, 0)) + 1
| where RiskScore >= 2
| project Computer, FirstPersistence, PersistenceEvents, FileName, CmdLines, ShadowEvents, RiskScore
| order by RiskScore desc, FirstPersistence asc

The script below is a rapid-response triage sweep for a suspected intrusion: exposed RDP, persistence planted in the last 7 days, and shadow-copy tampering.

# SILENTRANSOMGROUP Rapid Triage Sweep — run elevated on suspect hosts or via your EDR's remote shell
# Checks: exposed RDP config, persistence created in last 7 days, shadow copy state

Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
Write-Host "RDP Enabled: $rdpEnabled | NLA Enforced: $($nla -eq 1)"
if ($rdpEnabled -and $nla -ne 1) { Write-Host "[!] RDP exposed WITHOUT NLA — brute-force risk. Disable or restrict now." -ForegroundColor Red }

Write-Host "`n=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date | Format-Table -AutoSize

Write-Host "`n=== [3] Services Installed in Last 7 Days ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}} | Format-Table -AutoSize

Write-Host "`n=== [4] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "[!] NO shadow copies present — possible anti-recovery tampering (T1490)." -ForegroundColor Red }
else { $shadows | Select-Object InstallDate, DeviceObject | Format-Table -AutoSize }

Write-Host "`n=== [5] Recent vssadmin / bcdedit Execution Artifacts (Security log 4688, 7 days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'vssadmin|bcdedit|wmic.*shadowcopy' } |
    Select-Object TimeCreated, Message | Format-List

Write-Host "`nTriage complete. Any RED finding warrants escalation to IR and network isolation of the host." -ForegroundColor Yellow

Incident Response Priorities

T-minus detection checklist — catch it before encryption fires:

• Shadow-copy deletion or bcdedit ... recoveryenabled no execution anywhere in the estate (highest-fidelity pre-detonation signal)
• New scheduled tasks or services created by accounts that don't normally manage them, especially in bursts across multiple hosts
• Archive utilities (7z, rar) or exfil tools (rclone, MEGA, WinSCP) appearing on servers that hold document management or client matter data
• SMB admin-share enumeration and PsExec-style service binaries (PSEXESVC.exe) landing on file servers and hypervisor management planes
• Anomalous Kerberos ticket requests or DCSync-style replication traffic (credential harvesting ahead of domain-wide deployment)
• Disablement of EDR/backup agents via their management consoles or safe-mode boot attempts

Assets this threat class prioritizes for exfiltration:

• Document management systems (iManage, NetDocuments, ShareFile) — privileged client communications and litigation files
• Email archives of partners and deal teams
• HR/payroll exports and client PII
• Financial records, engagement letters, and billing data (used to calibrate ransom demands)
• Backup catalogs and vCenter/backup-console credentials — targeted to blind recovery options before detonation

Containment actions, ordered by urgency:

1. Isolate, don't power off — network-quarantine affected hosts via EDR; preserve memory for forensics
2. Disable compromised accounts enterprise-wide and force credential resets, prioritizing domain admins and service accounts observed in lateral movement
3. Block egress at the perimeter for known exfil tooling and unapproved cloud storage; inspect the last 14 days of outbound transfer volumes per host
4. Protect the recovery path — take backup consoles and vCenter offline from general network reach, verify offline/immutable backup integrity before anything else
5. Segment aggressively — deny server-to-server SMB/RDP except from hardened jump hosts
6. Engage counsel early — professional services firms face client-notification and privilege implications even when a claim is unverified; treat a credible leak-site listing as a tabletop trigger

Hardening Recommendations

Immediate (24 hours):

• Patch or mitigate the KEV perimeter items matching your stack: CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), CVE-2026-59316-class vCenter exposure — verify CVE-2026-59310 remediation and remove vCenter from any network reachability beyond a dedicated management VLAN
• Enforce MFA on all VPN and remote access; disable IKEv1 where not required
• Disable Office macros from the internet (Mark-of-the-Web blocking) for all professional services staff — phishing remains the cheapest entry
• Audit and restrict RDP: NLA enforced, gateway-only exposure, account lockout policies against brute force
• Deploy the Sigma rules above; alert on any shadow-copy deletion as P1

Short-term (2 weeks):

• Segment the management plane: vCenter, backup consoles, and CI/CD (TeamCity — see CVE-2026-63077) on isolated networks with dedicated privileged access workstations
• Immutable, offline backups with tested restoration runbooks; alert on backup job deletions or retention changes
• Egress filtering and DLP on document management systems — the exfil stage is where double extortion succeeds or fails
• EDR coverage audit across servers, not just endpoints; ransomware operators live on servers
• Supply-chain hygiene: pin and verify developer tooling versions (relevant to CVE-2026-48027), restrict build-agent internet access
• Tabletop the leak-site scenario: decide in advance who evaluates an unverified criminal claim, who talks to clients, and what your disclosure thresholds are

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub