NEW YORK--Ransomware gangs are increasingly sending operatives to victims' offices posing as IT technicians after remote social-engineering attempts fail, a tactic that has helped one prolific group extract large ransom payments from U.S. law firms, according to reporting by BankInfoSecurity and a new Coveware analysis.
BankInfoSecurity reported that the group known as Silent Ransom—also tracked as Luna Moth, Chatty Spider and UNC3753—has expanded its long-running social-engineering campaign by dispatching individuals to victim locations to steal sensitive data in person. The FBI warned earlier this month that the group has targeted organizations across multiple sectors, including finance, insurance and healthcare, while consistently focusing on U.S. law firms since spring 2023. Coveware said, "By threatening public exposure of sensitive legal records exfiltrated through targeted social engineering, the group secured large payments."
According to BankInfoSecurity, the FBI said Silent Ransom typically begins attacks with phishing emails or phone calls designed to convince employees to install remote-access software or surrender credentials. If those efforts fail, the attackers may send someone to the victim's office claiming to be an IT worker who needs to image a computer or create a backup. The FBI urged organizations to verify visitors' identities, establish clear authentication procedures for IT personnel and preserve surveillance footage if such incidents occur.
BankInfoSecurity also reported that the increasingly aggressive tactics come as the ransomware business model continues to weaken overall. Coveware found the percentage of victims paying ransoms fell from 23% in the first quarter to a record-low 19% in the second quarter of 2026, while payments in data-theft-only incidents dropped from 29% to 15%. Median ransom payments declined 50% to $150,000, although the average payment rose to $1.9 million, largely because of Silent Ransom's attacks on major law firms.
"We need to push it even closer to zero," Magnus Jelen, Coveware's lead director of incident response for the U.K. and EMEA, said of the percentage of victims paying ransoms, adding that stronger information sharing among "policymakers, law enforcement, industry leaders, insurance carriers and victims" is essential. Jelen also warned against trusting extortionists' promises to delete stolen data: "We see too many cases where the opposite turns out to be true. The data is kept and published anyway. Paying criminals for a promise no one can audit or enforce is not the way forward. Hope is not a strategy."