SILENTRANSOMGROUP: 5 Victims Posted in 72 Hours — Legal & Professional Services Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Published: 2026-08-14 | Source: Direct monitoring of SILENTRANSOMGROUP .onion leak infrastructure via ransomware.live

Executive Summary

Security Arsenal's dark web collection confirms SILENTRANSOMGROUP published 5 victims to its .onion leak site within a 72-hour window (2026-08-12 through 2026-08-13), a compressed posting cadence that signals an active detonation-to-disclosure pipeline. The victim set shows a deliberate concentration on professional services firms — specifically legal practices — spanning the United States and Germany. Two postings reference what appears to be the same law firm entity (Riker Danzig Scherer Hyland & Perretti / Riker Danzig LLP), a pattern consistent with either redundant victim records or staged escalation against a non-compliant victim.

Organizations in legal, accounting, consulting, and adjacent professional services verticals — particularly those with Check Point, Cisco FMC, Microsoft Exchange, or ConnectWise ScreenConnect in their perimeter stack — should treat this as an active-threat condition.

Threat Actor Profile — SILENTRANSOMGROUP

Analytic note: Public reporting on SILENTRANSOMGROUP remains thin. Profile fields marked "assessed" are derived from victimology, leak-site mechanics, and CVE correlation rather than confirmed insider or forum sourcing. Confidence: moderate.

Current Campaign Analysis

Sector Targeting

Of 5 postings in the last 100 records, 3 are confirmed Professional Services (all named victims are law firms) and 2 are listed as "Not Found" with redacted names (R...er, R... D...). The alphabetical clustering of redacted entries suggests either a bulk exfiltration event against multiple victims processed simultaneously, or staged pressure releases against entities whose names begin with "R" — possibly a data-sorting artifact of the group's leak-site CMS.

Geographic Concentration

• Germany (DE): 1 confirmed (Reminger — note: a firm of this name operates in both the US and Germany; country attribution reflects the leak site's own tagging)
• United States (US): 1 confirmed
• Unknown: 3

Victim Profile

Named victims are mid-sized regional law firms (estimated 100–500 employees, revenue roughly $30M–$150M USD). This is classic ransomware economics: large enough to pay, small enough to lack 24/7 SOC coverage, and holding extraordinarily sensitive client data (litigation materials, M&A work product, PII under attorney-client privilege) that amplifies extortion leverage.

Posting Frequency / Escalation Pattern

5 postings in ~48 hours with 4 of 5 landing on 2026-08-12 indicates a detonation wave — multiple intrusions executed in parallel reaching disclosure simultaneously. The duplicate Riker Danzig entries suggest escalation against a single non-compliant victim (posting under both the full legal entity name and a shortened variant to maximize search-engine and reputational impact).

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries with confirmed ransomware use align with the infrastructure typical of this victim profile (mid-market firms running commercial perimeter and RMM stacks):

Assessment: The Check Point and ScreenConnect CVEs are the most probable initial access pair for this campaign. Patch validation for both is a 24-hour action item.

Detection Engineering

Sigma Rules

---
title: VPN/Firewall Anomalous Authentication Followed by Internal Recon — SILENTRANSOMGROUP Initial Access Pattern
id: 8f3a2c1e-9b7d-4e5f-a1c2-silentrg0001
status: experimental
description: Detects successful VPN authentication from unusual geolocation/ASN followed within 30 minutes by internal host enumeration or admin tool execution — consistent with perimeter appliance exploitation (CVE-2026-50751 class) leading to hands-on-keyboard activity.
author: Security Arsenal Threat Intelligence
date: 2026/08/14
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: authentication
    product: vpn
detection:
    selection_success:
        event.outcome: success
    filter_geo_anomaly:
        source.geo.country_name|notin:
            - 'United States'
            - 'Germany'
            - '%known_business_countries%'
    condition: selection_success and filter_geo_anomaly
falsepositives:
    - Traveling executives (correlate with IdP travel notifications)
    - Corporate VPN egress nodes
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
---
title: RMM Tool Execution from Non-Standard Path — ScreenConnect/RMM Abuse
id: 8f3a2c1e-9b7d-4e5f-a1c2-silentrg0002
status: experimental
description: Detects execution of remote management tooling (ScreenConnect, AnyDesk, Atera, Syncro) from user-writable or temp directories — consistent with ransomware operators deploying unauthorized RMM for persistence and lateral movement after CVE-2024-1708-class compromise.
author: Security Arsenal Threat Intelligence
date: 2026/08/14
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_names:
        Image|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
            - '\AnyDesk.exe'
            - '\atera_agent.exe'
            - '\Syncro.exe'
    selection_paths:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\ProgramData\Temp\'
            - '\Windows\Temp\'
    condition: selection_names and selection_paths
falsepositives:
    - Legitimate RMM self-updaters (whitelist known MSP install paths and signer certs)
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
---
title: Pre-Encryption Staging — Shadow Copy Deletion and Backup Discovery
id: 8f3a2c1e-9b7d-4e5f-a1c2-silentrg0003
status: experimental
description: Detects the canonical pre-detonation sequence — vssadmin/wmic shadow copy deletion combined with backup catalog discovery — observed across virtually all double-extortion ransomware intrusions in the T-minus-60-minutes window.
author: Security Arsenal Threat Intelligence
date: 2026/08/14
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith: '\vssadmin.exe'
          CommandLine|contains|all:
              - 'delete'
              - 'shadows'
        - Image|endswith: '\wmic.exe'
          CommandLine|contains|all:
              - 'shadowcopy'
              - 'delete'
        - Image|endswith: '\bcdedit.exe'
          CommandLine|contains: 'recoveryenabled no'
    selection_backup_enum:
        CommandLine|contains:
            - 'wbadmin delete catalog'
            - 'wbadmin get versions'
    condition: selection_vss or selection_backup_enum
falsepositives:
    - Backup software maintenance windows (correlate with change tickets)
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.defense_evasion

Microsoft Sentinel KQL — Pre-Ransomware Staging Hunt

Hunts for the behavioral chain associated with this campaign: suspicious RMM/vpn-derived logon → PsExec/WMI lateral movement → mass file staging in a compressed archive directory → shadow copy tampering, all within a rolling 24h window.

let Window = 24h;
let SuspiciousStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where ProcessCommandLine has_any (
        "vssadmin delete shadows",
        "shadowcopy delete",
        "bcdedit",
        "wbadmin delete catalog",
        "psexec",
        "wmic /node:",
        "7z.exe a -p",
        "rar.exe a -hp")
    | project StagingTime=TimeGenerated, DeviceName, AccountName,
              FileName, ProcessCommandLine, InitiatingProcessFileName;
let AnomalousLogons =
    SigninLogs
    | where TimeGenerated > ago(Window)
    | where ResultType == 0
    | summarize arg_min(TimeGenerated, *) by UserPrincipalName, IPAddress
    | where IPAddress !startswith "10." and IPAddress !startswith "192.168.";
SuspiciousStaging
| join kind=leftouter (
    AnomalousLogons
    | project UserPrincipalName, IPAddress, Location, AppDisplayName
    ) on $left.AccountName == $right.UserPrincipalName
| summarize FirstSeen=min(StagingTime), LastSeen=max(StagingTime),
            Commands=make_set(ProcessCommandLine, 20),
            SourceIPs=make_set(IPAddress, 10)
    by DeviceName, AccountName
| extend RiskScore = iff(array_length(Commands) >= 3, "CRITICAL — probable pre-encryption staging", "HIGH")
| order by FirstSeen asc;

PowerShell — Rapid Response Sweep (Run Domain-Wide via GPO/Intune/SCCM)

Enumerates the three highest-signal artifacts for this playbook: newly created scheduled tasks (persistence), exposed RDP listeners, and Volume Shadow Copy health.

# SILENTRANSOMGROUP Rapid Triage — Security Arsenal 2026-08-14
# Run as SYSTEM/Domain Admin. Output to CSV for central collection.

$Report = @()

# 1. Scheduled tasks created in the last 7 days (persistence check)
$RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and (Get-Date $_.Date) -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date,
    @{N='Action';E={($_.Actions | ForEach-Object {$_.Execute + ' ' + $_.Arguments}) -join '; '}}

# 2. RDP exposure check
$RdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections -eq 0
$RdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
$NlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication -eq 1

# 3. Shadow copy integrity (pre-encryption tampering check)
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$ShadowCount = ($Shadows | Measure-Object).Count

# 4. Suspicious RMM services
$RmmServices = Get-Service | Where-Object {
    $_.Name -match 'ScreenConnect|AnyDesk|Atera|Syncro|Splashtop|TeamViewer'
} | Select-Object Name, Status, StartType

$Report += [PSCustomObject]@{
    Host             = $env:COMPUTERNAME
    Timestamp        = (Get-Date -Format o)
    RecentTaskCount  = ($RecentTasks | Measure-Object).Count
    RecentTasks      = ($RecentTasks | ConvertTo-Json -Compress)
    RdpEnabled       = $RdpEnabled
    RdpPort          = $RdpPort
    RdpNlaEnforced   = $NlaEnabled
    ShadowCopyCount  = $ShadowCount
    RmmServicesFound = ($RmmServices | ConvertTo-Json -Compress)
    Verdict          = if ($ShadowCount -eq 0 -and $RdpEnabled) { 'HIGH RISK' }
                       elseif (($RecentTasks | Measure-Object).Count -gt 5) { 'REVIEW' }
                       else { 'BASELINE' }
}

$Report | Export-Csv -Path ".\silentrg_triage_$env:COMPUTERNAME.csv" -NoTypeInformation
$Report | Format-List

# ALERT: ShadowCopyCount of 0 on a server that normally maintains VSS snapshots
# is a T-minus indicator — treat as active intrusion until disproven.

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. Shadow copy deletion events (Event ID 4688 with vssadmin delete shadows; Sigma rule #3 above) — the single most reliable T-minus indicator. If seen, assume detonation within the hour.
2. Mass archive creation — 7z/rar executions with password flags (-p, -hp) against file shares or DMS (iManage/NetDocuments) paths.
3. Unauthorized RMM presence — ScreenConnect/AnyDesk/Splashtop services not matching your MSP's authorized install path or signer.
4. Vpn logon → immediate internal SMB/RDP fan-out from an account with no prior history on that host.
5. Exchange IIS worker process (w3wp.exe) spawning cmd/powershell — legacy deserialization exploitation signature (CVE-2023-21529 class).
6. Backup console logons outside change windows or wbadmin delete catalog execution.

Assets This Gang Historically Prioritizes for Exfiltration

Based on the legal-sector victimology in this campaign:

• Document management systems (iManage Work, NetDocuments, Worldox) — client matter files are the crown jewels and the extortion leverage
• Litigation support and e-discovery repositories
• Email archives (Exchange/365 mailboxes of partners — privilege waivers and settlement strategy)
• HR and payroll exports (PII for secondary pressure)
• Trust/escrow account records and financial statements

Assume exfiltration precedes encryption. If you detect the staging phase, you may still prevent disclosure even if you cannot prevent detonation.

Containment Actions — Ordered by Urgency

1. Isolate affected hosts at the network layer (switch port shutdown / EDR network isolation) — do NOT power off; preserve memory for forensics
2. Disable the compromised identity chain — force-reset credentials for any account observed in lateral movement; revoke active sessions/refresh tokens in the IdP
3. Block RMM tooling at the egress proxy (ScreenConnect, AnyDesk, TeamViewer domains/IPs) and hunt for existing installations
4. Freeze perimeter changes — snapshot VPN/firewall configs; check for rogue admin accounts, new IKE/IPSec peers, and management-plane logins (Check Point, FMC)
5. Engage counsel early — legal-sector victims face privilege, ethics-notification, and potentially cross-border (DE/US GDPR + state bar) obligations; your IR retainer and cyber-insurance carrier should be engaged before the leak-site countdown expires
6. Do not pay without professional negotiation support — payment does not guarantee deletion, and this group's redacted-posting tactic suggests they weaponize partial disclosure

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1) and CVE-2024-1708 (ScreenConnect) — these are the two most probable entry vectors for this campaign. If ScreenConnect cannot be patched, take it off the internet entirely.
• Enforce MFA on all VPN and RMM access; audit VPN accounts for dormant/stale credentials
• Disable RDP on the perimeter; require VPN + NLA + MFA for any internal RDP; alert on 3389 exposure
• Deploy the Sigma rules above to your SIEM and enable the Sentinel KQL hunt as a scheduled analytics rule
• Verify VSS is functioning on file servers and that snapshots are stored on infrastructure unreachable from production credentials (immutable/offline backup)
• Block macro execution from internet-sourced Office files (Mark-of-the-Web policy) org-wide

Short-Term (2 Weeks)

• Segment the DMS and document repositories from general workstation VLANs; law firms should treat matter files like regulated data regardless of contract terms
• Deploy EDR with ransomware-specific rollback on all endpoints and file servers; verify tamper protection is enforced
• Implement egress filtering and DLP alerting on bulk outbound transfers (>10GB/24h to non-corporate destinations) — exfiltration is the actual leverage; encryption is just the timer
• Retire or upgrade legacy Exchange; apply the CVE-2023-21529 patch chain and migrate to 365 with conditional access if on-prem cannot be maintained at current patch level
• Establish a tested IR retainer and tabletop the legal-sector scenario (privilege-preservation, client notification, regulator/bar obligations) — the time to negotiate privilege strategy with counsel is before the intrusion
• Audit RMM inventory — one authorized tool, one authorized install path, everything else alerted

This briefing is based on live collection from criminal infrastructure. Victim postings on leak sites are claims by the threat actor and do not constitute confirmed breaches; named organizations should be treated as alleged victims pending independent verification.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub