Classification: TLP:CLEAR | Publication Date: 2026-10-29 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

SILENTRANSOMGROUP: 6 New Leak-Site Listings Concentrated on US Professional Services

Executive Summary

Between 2026-10-26 and 2026-10-28, the ransomware operation tracked as SILENTRANSOMGROUP posted six new victim entries to its dark web leak site, according to monitoring via ransomware.live. Three of the named organizations are US-based professional services firms — specifically law firms: Lowenstein Sandler LLP, Morrison Foerster, and Morrison Cohen. The remaining three listings are partially redacted ("T... E...", "S... H...", "L...") with sectors and countries not yet disclosed, a common tactic used to pressure victims before full public naming.

Critically, all six listings are single-source: they appear on one crawler only, with no independent second-crawler confirmation that the postings even exist on the gang's site. These are accusations by a criminal group, not confirmed breaches. Regardless, the pattern — a cluster of US law firms claimed within a 48-hour window — warrants immediate defensive posture review by any professional services organization, because law firms hold concentrated volumes of client-privileged, M&A, litigation, and regulatory data that commands premium extortion leverage.

This briefing provides a threat actor profile, campaign analysis, Sigma/KQL/script detection content, and prioritized IR and hardening guidance.

Sourcing & Verification

0 of 6 listings were independently observed by a second leak-site crawler; all 6 appear on a single source only (ransomware.live). Treat every listing as low-confidence until corroborated.
Inclusion in this briefing reflects the threat actor's claim only and is not confirmation of a breach. No corroboration tier in our data confirms a breach — only the organization itself or its regulator can do that.
A named organization may dispute the listing, and a denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and data type, and not every incident is reportable. Neither silence nor denial settles the question.
Security Arsenal will publish corrections as new information emerges and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — SILENTRANSOMGROUP

SILENTRANSOMGROUP is a comparatively low-visibility actor in the current ecosystem. Verified public reporting on the group is limited, and defenders should treat profile details as analyst assessment rather than established fact:

Aliases: None firmly attributed in public reporting. The name appears designed to emphasize a "quiet" extortion model — negotiating privately before public leaking.
Operating model: Assessed to operate as a closed or semi-closed group rather than a large open RaaS program, based on its low posting volume (6 postings in the last 100 tracked across the ecosystem sample) and tightly clustered victim release cadence.
Extortion approach: Double extortion — data theft followed by threatened publication, with staged redacted listings (initials-only entries like "T... E...") used as escalation pressure before full naming. This matches the classic leak-site negotiation playbook.
Ransom demands: No verified demand figures are public for this group. For mid-market professional services targets, comparable crews typically demand in the low-to-mid seven figures, scaling to perceived ability to pay and cyber-insurance coverage.
Initial access (assessed, not confirmed for these listings): Groups with this profile commonly rely on (1) exploitation of internet-facing remote access (VPN gateways, firewalls, RDP), (2) phishing with malicious attachments/links, and (3) valid credentials purchased from initial access brokers.
Dwell time: Crews in this tier typically dwell days to a few weeks between access and detonation/leak, using the interval for reconnaissance, privilege escalation, and bulk data staging.

We deliberately avoid inventing a more detailed biography. Where intelligence on a group is thin, honest uncertainty is more useful than fabricated attribution.

Current Campaign Analysis

Sector targeting: Of the six listings, all three fully named organizations fall under Professional Services, and all three are US law firms. This is a notable concentration: legal sector victims provide outsized extortion leverage because a single firm aggregates sensitive data belonging to hundreds of corporate clients — deal documents, litigation strategy, privileged communications, and PII.

Geographic concentration: All named victims are in the United States. The three redacted listings have no confirmed country or sector.

Victim profile: The named firms range from mid-size to large full-service law practices, with estimated revenues from the low tens of millions to several hundred million USD annually. This matches the "mid-market sweet spot" profile: large enough to pay, often less hardened than Fortune 100 enterprises.

Posting frequency / escalation pattern: One listing on 2026-10-26, then a burst of five on 2026-10-28. Burst posting after a single probe listing is characteristic of a group batch-publishing victims whose negotiations failed or timed out. Watch for: (a) the redacted entries being fully named in coming days, and (b) countdown timers or data-sample releases as escalation.

CVE linkage (hypothesis only): We have no evidence tying any specific CVE to any specific listing above. However, the group's assessed initial access pattern (edge-device and remote-access exploitation) aligns with several vulnerabilities currently on CISA's Known Exploited Vulnerabilities list with confirmed ransomware use:

CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): direct VPN edge compromise.
CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password: management-plane takeover of perimeter infrastructure.
CVE-2026-59310 — VMware vCenter path traversal: virtualization-layer compromise enabling mass VM encryption.
CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD foothold, relevant for supply-chain-adjacent access.
CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply chain vector.

Any unpatched exposure of these products should be treated as a candidate entry point for campaigns of this type and patched on an emergency basis.

Detection Engineering

The following detections target TTPs consistent with this class of operation: edge/RDP initial access, phishing payload execution, lateral movement via PsExec/WMI, and pre-encryption data staging and shadow copy deletion.

YAML

---
title: SILENTRANSOMGROUP - Pre-Encryption Defense Evasion and Shadow Copy Deletion
id: 7f3a2c10-5e4b-4d91-9a01-silent001
status: experimental
description: Detects Volume Shadow Copy deletion and backup catalog tampering commonly executed by ransomware operators immediately before detonation, consistent with double-extortion group playbooks.
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
  definition: Sysmon or Security 4688 with command line auditing enabled
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance scripts (rare on servers; investigate context)
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: SILENTRANSOMGROUP - Lateral Movement via PsExec Service Install or WMI Remote Execution
id: 7f3a2c10-5e4b-4d91-9a02-silent002
status: experimental
description: Detects remote service creation patterns consistent with PsExec-style lateral movement and WMI-based remote process execution used during ransomware staging.
author: Security Arsenal Threat Intelligence
date: 2026/10/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec_service:
    Image|endswith: '\services.exe'
    CommandLine|contains:
      - 'PSEXESVC'
      - '\ADMIN$\'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  condition: selection_psexec_service or selection_wmi_remote
falsepositives:
  - Legitimate administrative tools (SCCM, PDQ) — baseline known management account/source host pairs
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
---
title: SILENTRANSOMGROUP - Data Staging via Archiving Tools and Rclone-Style Exfiltration
id: 7f3a2c10-5e4b-4d91-9a03-silent003
status: experimental
description: Detects mass archive creation and cloud-sync exfiltration tooling (rclone, MEGA clients) frequently used by extortion crews to stage stolen data before encryption.
author: Security Arsenal Threat Intelligence
date: 2026/10/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_archivers:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -v'
  selection_exfil_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\megasync.exe'
      - '\filezilla.exe'
  condition: selection_archivers or selection_exfil_tools
falsepositives:
  - IT backup/archival tasks — alert on execution from user profiles, temp paths, or non-IT accounts
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002

The following Sentinel hunt query identifies lateral movement and pre-ransomware staging: anomalous SMB admin-share writes followed by remote service creation within a short window.

KQL — Microsoft Sentinel / Defender

// SILENTRANSOMGROUP hunt: admin-share write -> remote service creation within 30 min
// Requires: Sysmon EventID 11 (FileCreate) and EventID 1 (ProcessCreate) or Security 4697/7045
let window = 30m;
let adminWrites =
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FolderPath has_any (@"\\ADMIN$\", @"\\C$\Windows\")
    | where FileName endswith ".exe" or FileName endswith ".dll"
    | project WriteTime=TimeGenerated, TargetDevice=DeviceName, DroppedFile=FileName, FolderPath, InitiatingProcessAccountName;
let remoteServices =
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where FileName =~ "services.exe" or InitiatingProcessFileName =~ "services.exe"
    | extend NewService = extract(@"([A-Za-z0-9_]{4,20})\.exe", 0, ProcessCommandLine)
    | project ServiceTime=TimeGenerated, ServiceDevice=DeviceName, ServiceCmd=ProcessCommandLine, Account=AccountName;
adminWrites
| join kind=inner remoteServices on $left.TargetDevice == $right.ServiceDevice
| where ServiceTime between (WriteTime .. (WriteTime + window))
| project TargetDevice, WriteTime, DroppedFile, ServiceTime, ServiceCmd, InitiatingProcessAccountName, Account
| summarize FirstSeen=min(WriteTime), ServicesCreated=make_set(ServiceCmd) by TargetDevice, DroppedFile, InitiatingProcessAccountName
| order by FirstSeen desc;

Rapid-response audit script — run on servers and domain controllers to surface exposed RDP, suspicious scheduled tasks created in the last 7 days, and shadow copy tampering:

PowerShell

# Security Arsenal - SILENTRANSOMGROUP Rapid Triage (run elevated, PS 5.1+)
$report = @()

# 1) RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report += [pscustomobject]@{Check='RDP Enabled'; Result=$rdpEnabled; Detail="NLA=$nla (1=required)"}

# 2) Scheduled tasks created in last 7 days (common persistence vector)
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
         Select-Object TaskName, TaskPath, Date
$report += [pscustomobject]@{Check='New Scheduled Tasks (7d)'; Result=$tasks.Count; Detail=($tasks.TaskName -join '; ')}

# 3) Shadow copy status
$shadows = (Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue | Measure-Object).Count
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 200 -ErrorAction SilentlyContinue |
             Where-Object { $_.Message -match 'Shadow Copy' } | Select-Object -First 5 TimeCreated, Message
$report += [pscustomobject]@{Check='Shadow Copies Present'; Result=$shadows; Detail='0 = possible vssadmin deletion'}

# 4) Recent service installations (PsExec-style staging)
$svc = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
       Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}}
$report += [pscustomobject]@{Check='Services Installed (7d)'; Result=($svc|Measure-Object).Count; Detail=($svc.Binary -join '; ')}

# 5) Suspicious archive/exfil tooling execution (4688 with cmdline required for full fidelity)
$tools = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
         Where-Object { $_.Message -match '(rclone|rar\.exe|7z\.exe|psexesvc)' } | Select-Object -First 20 TimeCreated, Message
$report += [pscustomobject]@{Check='Staging Tool Executions (7d)'; Result=($tools|Measure-Object).Count; Detail=($tools.TimeCreated -join '; ')}

$report | Format-List
$report | Export-Csv "$env:TEMP\silentransom_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation

Incident Response Priorities

T-minus detection checklist (before encryption fires):

Unexpected vssadmin delete shadows, bcdedit recovery-disable, or wbadmin delete catalog execution (highest-signal pre-detonation indicator).
New local/domain admin accounts, or sudden additions to privileged groups outside change windows.
Mass archive creation (rar/7z with password flags) on file servers, especially legal document management systems (iManage, NetDocuments, SharePoint repositories).
rclone/MEGA/FileZilla execution or large sustained egress to unfamiliar cloud storage or VPS IPs.
Remote service creation (7045) chaining from admin-share file drops — classic staging.
EDR/AV tampering: service stops, driver unloads, or uninstall attempts on multiple hosts.

Assets this profile of gang historically prioritizes for exfiltration: document management systems and matter files (for law firms: privileged client communications, deal rooms, litigation holds), HR and payroll PII, email archives of partners/executives, financial and trust-accounting records, and client contracts containing confidentiality clauses that amplify extortion leverage.

Containment actions, ordered by urgency:

Isolate affected subnets/hosts at the switch or EDR level — do not power off (preserves memory evidence).
Disable compromised accounts and force credential resets for all privileged users; revoke active sessions and tokens.
Block identified exfil destinations at the egress proxy/firewall; throttle or alert on bulk outbound transfer.
Verify backup integrity and confirm offline/immutable copies are untouched before attacker achieves backup destruction.
Preserve volatile evidence (memory, prefetch, USN journal, firewall/VPN logs) before remediation.
Engage external IR counsel early — for law firms, breach of client data triggers notification obligations to their clients and potentially regulators; privilege structuring matters from hour one.

Hardening Recommendations

Immediate (24 hours):

Patch or mitigate the KEV-listed edge exposures: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter). If patching is impossible, take the interface off the internet.
Enforce MFA on all remote access (VPN, RDP gateways, webmail); disable direct internet-facing RDP entirely.
Deploy the Sigma rules above; alert page-worthy on shadow copy deletion.
Block execution of rclone, 7z/rar from user-writable paths via AppLocker/WDAC for non-IT accounts.
Audit scheduled tasks and services created in the last 14 days on servers and DCs.

Short-term (2 weeks):

Segment document management systems and file servers from general user VLANs; require jump-host access for administration.
Implement egress filtering with deny-by-default for cloud storage domains not in business use; alert on sustained outbound volume anomalies.
Deploy immutable/offline backups with separate credentials and test restore of one critical system.
Enable LSASS protection, Credential Guard, and restrict administrative tiering (no Domain Admin logons outside PAWs/DCs).
Establish a dark-web monitoring watch on your own organization name and key client names so leak-site claims reach you in minutes, not via a journalist.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

SILENTRANSOMGROUP: 6 New Leak-Site Listings Concentrated on US Professional Services — Verification Caveats, Detection Rules & Response Priorities