What You Need to Know
- The Silent Ransom Group (also known as Luna Moth) is actively targeting U.S. law firms with data theft and extortion campaigns. The FBI issued a formal alert in May 2026.
- These attacks do not use traditional ransomware. Instead, attackers steal confidential client data and threaten to expose it unless firms pay.
- Tactics include impersonating IT staff by phone and email, and in some cases, showing up in person at firm offices.
- Law firm data extortion is effective because legal information is confidential, regulated, and extremely valuable to threat actors.
- Firms that invest in employee training, phishing-resistant MFA, and verified IT access procedures are significantly harder to compromise.
A new wave of law firm data extortion attacks is active right now, and the tactics behind them are unlike anything most legal teams have prepared for. The FBI issued a formal alert in May 2026 identifying a cybercriminal group called the Silent Ransom Group, also known as Luna Moth, as the primary threat actor behind a growing number of targeted attacks on U.S. law firms. These are not opportunistic attacks. They are calculated, industry-specific campaigns designed to exploit the one thing that makes law firms valuable: their confidential data.
What Is Law Firm Data Extortion?
Law firm data extortion is different from traditional ransomware. In a classic ransomware attack, criminals encrypt a firm’s systems and demand payment to restore access. In a data extortion attack, the goal is not disruption. The goal is access. Attackers quietly infiltrate firm networks, copy sensitive client files, and then threaten to publicly release that information unless the firm pays.
For law firms, that threat carries significant weight. Privileged communications, litigation strategy, merger and acquisition details, intellectual property, and sensitive financial data are all at stake. Because this information belongs to clients, not just the firm, the pressure to resolve an incident quickly can be enormous. Threat actors understand this dynamic, and they exploit it.
The FBI’s alert specifically states that the Silent Ransom Group has consistently targeted U.S.-based law firms and that its members understand the sensitivity of legal data gives them strong leverage during extortion demands.
How the Silent Ransom Group Operates
The Silent Ransom Group does not rely on malware as its primary entry point. Instead, it uses social engineering to gain trust and access. The typical attack follows a recognizable pattern.
First, attackers contact firm employees by phone or email, posing as internal IT personnel or third-party support vendors. They create a scenario, often a routine security check or system update, that gives them a reason to ask employees for help. Next, they convince those employees to install legitimate remote access tools, such as AnyDesk or similar software, onto firm computers. Once access is established, attackers move quickly to locate and copy valuable data.
What makes these attacks particularly difficult to detect is that legitimate software is used throughout. Normal business operations continue without interruption. The breach often goes unnoticed until the extortion demand arrives.
More recently, the FBI has documented cases where members of the Silent Ransom Group escalated to in-person tactics. Individuals posing as IT support staff have physically visited law firm offices in an attempt to gain direct access to systems. Google Cloud’s threat intelligence team confirmed in June 2026 that the group combines both digital and physical intrusion methods as part of a coordinated campaign.
Why Law Firms Are the Target
Law firm data extortion works because legal information is uniquely valuable and uniquely sensitive. For many firms, the greatest cyber risk is not a system going offline. It is the exposure of confidential client information, which can trigger reputational damage, bar complaints, regulatory scrutiny, and client liability.
The Silent Ransom Group recognizes this. The group specifically seeks out firms with high-value matters, including those handling M&A transactions, litigation with significant financial stakes, and clients in regulated industries. The more sensitive the data, the stronger the extortion leverage.
In addition, law firms have historically invested more in legal talent than in cybersecurity infrastructure. That gap creates opportunity for threat actors who are patient, disciplined, and well-organized.
What Your Firm Should Do Now
The most effective defenses combine technology controls with employee behavior changes. Because these attacks rely on deception and access rather than malware, your people are both the most targeted and the most important line of defense.
Require strict verification for all IT requests. Anyone contacting your firm claiming to be IT support, whether by phone, email, or in person, should go through a documented verification process before accessing any system. The FBI specifically recommends this step.
Train employees to recognize social engineering. Staff at every level should know what a social engineering attempt looks like. They should also know exactly how to escalate a suspicious request without embarrassment or hesitation. Therefore, training should be ongoing, not a one-time event.
Limit and monitor remote access tools. Legitimate remote access software is a standard tool in IT management. However, your firm should maintain an approved list of tools and flag any installation request that does not come through proper channels.
Implement phishing-resistant multi-factor authentication (MFA). Standard SMS-based MFA is vulnerable to certain social engineering tactics. Phishing-resistant MFA, such as hardware security keys or passkey-based authentication, provides a stronger barrier against unauthorized access.
Review your cyber insurance coverage. Insurers are already responding to the rise in law firm data extortion claims by tightening underwriting requirements. Firms without strong controls in place may face reduced coverage options, higher premiums, or increased retentions. Proactively addressing these gaps puts your firm in a stronger position.
How CIO Landing Supports Law Firms
CIO Landing works with law firms in the Chicago area to build and maintain the kind of IT environment that holds up under real-world attack conditions. We configure and manage MFA, set up verified remote access policies, conduct employee security awareness training, and monitor firm networks for signs of unauthorized activity.
We understand that legal teams operate under time pressure and confidentiality obligations. So, our approach is designed to integrate with your workflows, not disrupt them. And when a security concern does arise, we act on it immediately, because we know that in a law firm data extortion scenario, response time matters.
If you want to understand where your firm stands today, schedule a discovery call with CIO Landing. We will walk through your current environment and identify the gaps before a threat actor does.
You can also explore our dedicated IT services page for law firms to learn how we support legal teams specifically. For broader context on AI and cybersecurity risks in the legal sector, see our recent post on Claude for Legal: What Law Firms Need to Know.