Key points
- Silent Ransom Group allegedly extorted $207 million from 27 law firms.
- The attacks relied on phone calls and social engineering, not file encryption.
- The campaign targeted law firms almost exclusively over a six-month period.
The Silent Ransom Group has allegedly extorted $207 million from 27 law firms in a six-month period, according to a report by Security Affairs. Unlike traditional ransomware operators, this group did not encrypt files or deploy malware payloads. Instead, the attackers relied entirely on phone calls and social engineering to coerce victims into paying. The campaign targeted law firms almost exclusively, demonstrating that human manipulation can be as lucrative as technical exploitation.
By the numbers
- $207 million: Total alleged extortion amount extracted by the group.
- 27: The number of law firms targeted in the six-month campaign.
- 0: The number of malware payloads or encryption tools used in the attacks.
What the figures mean
The $207 million total indicates that social engineering remains a highly profitable attack vector for threat actors. By avoiding encryption, the Silent Ransom Group eliminates the technical friction that often delays ransomware payments. Victims are pressured immediately through phone calls, creating a sense of urgency that bypasses standard incident response protocols. The focus on 27 law firms suggests these organizations are viewed as high-value targets with sensitive data and limited tolerance for reputational damage.
What should you do?
Managed service providers must recognize that perimeter defenses are insufficient against this type of attack. Since no malware was deployed, traditional endpoint detection and response tools would not have triggered alerts. Security teams need to implement strict verification protocols for any financial requests received via phone. Staff training should emphasize that legitimate partners will not demand immediate wire transfers without multi-channel confirmation. Monitoring for unusual payment instructions is critical to preventing further losses.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe: Silent Ransom Group
- Require multi-channel verification for all requests involving financial transfers or sensitive data disclosure.
- Train help desk and executive staff to recognize social engineering tactics used over phone calls.
- Implement strict policies that prohibit immediate payment of demands without legal and security review.
- Monitor communication logs for unusual patterns in requests from external parties.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Silent Ransom Group use encryption in these attacks?
No, the report states the group did not use encryption or malware, relying instead on phone calls.
How much money was allegedly extorted in this campaign?
The group allegedly extorted $207 million from 27 law firms over six months.
Which industry was primarily targeted by this group?
The attacks aimed almost entirely at law firms, according to Security Affairs.
