Classification: TLP:CLEAR | Publication Date: 2026-09-24 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

SILENTRANSOMGROUP: 6 New Leak-Site Listings Claimed — Legal & Professional Services Targeting Analysis and Detection Engineering

Executive Summary

Between 2026-09-21 and 2026-09-23, the extortion group tracked as SILENTRANSOMGROUP published six new listings on its dark web leak site. Three of the named organizations — Clark Hill, Cozen O'Connor, and Hogan Lovells Cadwalader — are identified in the data as Professional Services entities, several of them recognizable law firms; the remaining three listings are redacted or unattributed ("W... B...", "B...", "W..."). Named-country data points to the United States.

Every one of these six listings is a claim by a criminal actor, not a confirmed breach. All six are single-source observations (see Sourcing & Verification). However, the pattern — a burst of legal-sector names posted within a 72-hour window — is consistent with SILENTRANSOMGROUP's historically documented focus on law firms and professional services, where the leverage of client-confidential data maximizes extortion pressure. Security teams at law firms and professional services organizations should treat this as a hunt-now signal, regardless of whether any individual claim is accurate.

Sourcing & Verification

• 0 of 6 listings in this dataset were independently observed by a second leak-site crawler. 6 of 6 appear on a single source only (ransomware.live). SINGLE-SOURCE means no second crawler has confirmed the posting even exists on the gang's site.
• Inclusion in this briefing reflects the threat actor's claim. It is not confirmation of a breach of any named organization. Only an organization itself, or its regulator, can confirm an incident.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — SILENTRANSOMGROUP

SILENTRANSOMGROUP (also tracked in industry reporting under names associated with "Silent Ransom" activity; aliasing in the extortion ecosystem is fluid and reporting overlaps with callback-phishing extortion clusters) operates primarily as a data-theft extortion operation rather than a traditional encrypt-and-leak RaaS.

Key profile elements, based on open reporting on this cluster's tradecraft:

• Model: Closed group / small affiliate circle rather than open RaaS. This group is not widely known to recruit affiliates on forums; activity volumes are lower and more targeted than high-churn RaaS brands.
• Extortion approach: Data-theft-first. Historically, this cluster has been associated with exfiltration-only extortion — stealing sensitive data and threatening publication without necessarily deploying an encryptor. When encryption is used, it follows exfiltration (double extortion).
• Initial access: Strongly associated with callback phishing (BazarCall-style) — emails impersonating subscription invoices that induce the victim to phone the attacker, who then socially engineers installation of remote access tooling (legitimate RMM software such as AnyDesk, ScreenConnect-style tooling, or similar). Secondary vectors include abused remote access services (VPN/RDP) and credentials from infostealer markets.
• Ransom demands: Reporting on this cluster indicates demands scaled to the sensitivity of stolen data rather than pure revenue — legal-sector victims face particularly high pressure because of attorney-client privilege exposure. Demand figures vary widely; no reliable average exists in public reporting for this specific brand.
• Dwell time: Because the model leans on data theft rather than mass encryption, dwell time can be short and quiet — exfiltration within days of access in some reported cases, with leak-site posting arriving weeks later if payment fails. Defenders should not assume a long, noisy dwell window.

Caveat: attribution of specific tradecraft to this exact leak-site brand carries uncertainty; treat the above as the best available cluster-level picture, not ground truth on any single listing.

Current Campaign Analysis

Sector targeting

The 2026-09-21 → 2026-09-23 posting wave shows a clear professional services / legal skew: Clark Hill, Cozen O'Connor, and Hogan Lovells Cadwalader are all listed under Professional Services, and the named entities are law firms. Law firms aggregate the confidential data of hundreds of downstream clients — M&A materials, litigation strategy, PII, regulatory filings — making them force-multiplier extortion targets. The three redacted listings (sector "Not Found") cannot be assessed.

Geographic concentration

Where country data exists, it is US-only. This matches the cluster's historical emphasis on US-based professional services organizations.

Victim profile

The named firms are mid-to-large professional services organizations, typically in the hundreds-to-thousands of employees range with revenues plausibly in the high eight-to-nine figures — exactly the band with enough cyber-insurance-backed liquidity to pay, and enough reputational exposure to pay quietly.

Posting cadence / escalation

Six listings in three days is a burst pattern, not a steady drip. Bursts of same-sector listings often indicate either (a) a completed campaign wave being published after negotiations failed, or (b) a deliberate pressure/proof-of-capability display aimed at the sector at large. Either interpretation argues for immediate hunting across the legal/professional services vertical.

CVE linkage — hypothesis only

We have no evidence tying any specific CVE to any specific listing above. At sector level, the CISA KEV entries below represent the exposed-edge and build-pipeline attack surface this class of actor is known to favor, and should be treated as priority patch targets for organizations matching the victim profile — this is exposure analysis, not attribution:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): perimeter devices are a classic quiet-entry point for data-theft actors. KEV 2026-06-08.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: management-plane compromise enables blind-spot creation during exfil. KEV 2026-07-29.
• CVE-2026-59310 — VMware vCenter path traversal: virtualization-plane access enables mass data access prior to theft. KEV 2026-08-18.
• CVE-2026-63077 — JetBrains TeamCity deserialization: build-server compromise is relevant to the supply-chain angle given this group's phishing-with-tooling delivery style. KEV 2026-08-05.
• CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply chain exposure. KEV 2026-05-27.

Detection Engineering

The following detections target this cluster's known playbook: callback-phishing delivery of legitimate RMM tooling, quiet data staging and archival, and bulk exfiltration — with secondary coverage for the perimeter/RDP access path.

---
title: SILENTRANSOMGROUP - Callback Phishing RMM Tool Execution
id: 9f3a1c2e-7b44-4e1a-9c0d-srg00001
description: Detects execution of remote monitoring/management tooling commonly installed via callback (BazarCall-style) phishing, consistent with SILENTRANSOMGROUP initial access tradecraft
status: experimental
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.exe'
      - '\screenconnect.clientservice.exe'
      - '\splashtop.exe'
      - '\sr_service.exe'
      - '\teamviewer.exe'
      - '\aeroadmin.exe'
      - '\netwire.exe'
      - '\zohoassist.exe'
  filter_known_good:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_rmm and not filter_known_good
falsepositives:
  - Legitimate IT-installed RMM outside Program Files paths
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.command_and_control
  - attack.t1219
---
title: SILENTRANSOMGROUP - Pre-Extortion Data Staging and Archive Creation
id: 9f3a1c2e-7b44-4e1a-9c0d-srg00002
description: Detects mass archive creation with compression and password/encryption flags typical of data staging before exfiltration in extortion-only operations
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
      - '\winzip.exe'
  selection_flags:
    CommandLine|contains:
      - ' -p'
      - ' -hp'
      - ' a '
      - ' -v'
  selection_paths:
    CommandLine|contains:
      - '\Users\'
      - '\\'
      - '.pst'
      - 'share'
  condition: selection_tool and selection_flags and selection_paths
falsepositives:
  - Backup software, admin archival tasks
level: medium
tags:
  - attack.collection
  - attack.t1560.001
---
title: SILENTRANSOMGROUP - Volume Shadow Copy Deletion Prior to Encryption
id: 9f3a1c2e-7b44-4e1a-9c0d-srg00003
description: Detects shadow copy deletion or resize attempts, a near-universal pre-encryption step when this cluster does deploy an encryptor
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'Win32_ShadowCopy'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare legitimate admin maintenance
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

// SILENTRANSOMGROUP Hunt: RMM tooling install + outbound exfil correlation (Microsoft Sentinel)
// Looks for newly observed RMM process executions followed by high-volume outbound transfers
// from the same host within a 48h window — the data-theft-first pattern.
let lookback = 14d;
let rmmProcs = dynamic(["anydesk.exe","screenconnect.exe","screenconnect.clientservice.exe",
  "splashtop.exe","sr_service.exe","teamviewer.exe","aeroadmin.exe","zohoassist.exe" ,
  "rclone.exe","megasync.exe","filezilla.exe","winscp.exe"]);
let rmmHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any (rmmProcs)
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
                CmdLines=make_set(ProcessCommandLine, 5), Accounts=make_set(AccountName, 5)
              by DeviceName, FileName;
let exfilSuspects =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteIPType == "Public"
    | summarize ConnCount=count(), DistinctRemotes=dcount(RemoteIP),
                RemoteHosts=make_set(RemoteUrl, 10)
              by DeviceName, bin(TimeGenerated, 1h)
    | where ConnCount > 500 or DistinctRemotes > 25;
rmmHits
| join kind=inner (exfilSuspects) on DeviceName
| where TimeGenerated between (FirstSeen .. FirstSeen + 48h)
| project DeviceName, RMM=FileName, FirstSeen, CmdLines, Accounts,
          HourBucket=TimeGenerated, ConnCount, DistinctRemotes, RemoteHosts
| order by FirstSeen asc;

# SILENTRANSOMGROUP Rapid Triage — run on suspected hosts (elevated PowerShell)
# Checks: exposed RDP, new scheduled tasks (7d), suspicious RMM installs, shadow copy health
Write-Host "=== [1] RDP Exposure ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - verify NLA & restrict source IPs'}else{'No'}) | NLA: $($nla.UserAuthentication)"

Write-Host "=== [2] Scheduled Tasks Created/Modified Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{n='Action';a={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "=== [3] Unexpected RMM / Transfer Tool Installations ===" -ForegroundColor Cyan
$rmm = 'anydesk','screenconnect','splashtop','teamviewer','aeroadmin','zoho','rclone','megasync','filezilla','winscp'
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
                'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Where-Object { $d=$_.DisplayName; $rmm | Where-Object { $d -match $_ } } |
  Select-Object DisplayName, InstallDate, Publisher | Format-Table -AutoSize
Get-ChildItem "$env:PUBLIC","$env:TEMP","$env:USERPROFILE\Downloads" -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $rmm | Where-Object { $_.Name -match $_ } } |
  Select-Object FullName, CreationTime | Format-Table -AutoSize

Write-Host "=== [4] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: No shadow copies present - investigate for deletion (T1490)" } else {
  $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
vssadmin list shadows 2>&1 | Select-Object -First 20

Write-Host "=== [5] Large New Archive Files (staging artifacts, 7d) ===" -ForegroundColor Cyan
Get-ChildItem 'C:\Users','C:\ProgramData' -Recurse -Include *.zip,*.rar,*.7z -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 100MB } |
  Select-Object FullName, Length, CreationTime | Format-Table -AutoSize

Incident Response Priorities

T-minus detection checklist (before encryption or before leak-site publication)

1. RMM tooling you did not deploy — new AnyDesk/ScreenConnect/Splashtop services or portable executables outside Program Files. This is the single highest-fidelity indicator for this cluster.
2. Inbound calls followed by software installs — helpdesk or user reports of "invoice/subscription" phone calls that ended with a support agent "helping" install something.
3. Archive bombs — large .rar/.7z files appearing under user profiles or ProgramData, especially password-protected.
4. Cloud sync tooling — rclone, MEGAsync, FileZilla, WinSCP executions or configs pointing at non-corporate endpoints.
5. Egress anomalies — sustained multi-GB outbound flows to consumer cloud storage or bulletproof hosts, particularly outside business hours.
6. Shadow copy deletion and bcdedit recoveryenabled no — signals the encryptor phase if the actor escalates beyond theft-only.

Assets this group historically prioritizes for exfiltration

• Document management systems (iManage, NetDocuments-style repositories) — the crown jewels at law firms.
• Email PST/OST exports and litigation matter folders.
• HR/PII records and client intake data.
• Matter-associated privileged communications — the core extortion leverage.

Containment actions, ordered by urgency

1. Kill unauthorized RMM sessions — block the RMM vendor domains/IPs at egress, terminate processes, disable created services.
2. Isolate affected hosts from the network (EDR isolate), do not power off — preserve volatile memory.
3. Reset credentials for any account observed on touched hosts; assume domain credentials on those boxes are compromised.
4. Block exfil channels — temporarily restrict egress to consumer storage/file-sharing destinations enterprise-wide.
5. Preserve evidence — process logs, RMM connection logs, firewall/netflow for the dwell window.
6. Engage counsel and IR retainer early — for law firms, privilege and client-notification analysis must begin before facts are fully established.

Hardening Recommendations

Immediate (24 hours)

• Application control for RMM: Allowlist-approved remote access tools only; alert on any other execution (the Sigma rule above operationalizes this).
• Egress filtering: Deny outbound to consumer sync/storage services not in business use; alert on rclone-style tools.
• Patch KEV perimeter items: Check Point gateway (CVE-2026-50751) and Cisco FMC (CVE-2026-20316) — emergency change if internet-facing.
• User brief on callback phishing: One-page advisory to all staff: no legitimate vendor asks you to call a number in an invoice email and install software. Give the helpdesk a verification script.
• RDP audit: Confirm no internet-exposed RDP; enforce NLA and gateway-only access.

Short-term (2 weeks)

• Segment document management systems behind dedicated access tiers with step-up authentication; log and alert on bulk-read patterns.
• Deploy egress DLP with volume baselining tuned per host class — exfil-only extortion is invisible without egress visibility.
• Patch vCenter and TeamCity (CVE-2026-59310, CVE-2026-63077) and audit developer tooling for the Nx supply-chain exposure (CVE-2026-48027).
• Tabletop a data-theft-only scenario — most IR plans are built around encryption; this cluster often never encrypts. Legal, comms, and client-notification workflows must function without a decryptor decision.
• Implement helpdesk verification workflow for any inbound request involving software installation or credential resets.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub