Silent Ransom Group Targets Las Vegas Law Firms: FBI Warns of Fake IT-Call Extortion

The Attack That Starts With a Phone Call

Most law firms in Clark County think about cybersecurity the way they think about fire suppression — a compliance box, handled by the building. That assumption is now dangerous. The legal industry is not being caught in the blast radius of attacks aimed at someone else. It is being deliberately and specifically hunted, by a group the FBI has publicly named.

The group is Silent Ransom Group, also tracked as Luna Moth, Chatty Spider, and UNC3753. It has been working US law firms since spring 2023, and it escalated sharply through 2025 and into 2026. The FBI issued a FLASH advisory describing the method in detail, because the method is unusually effective and requires almost no technical sophistication to pull off.

Here is what makes it different: there is often no malware at all. An operator simply telephones an attorney or a paralegal, says they are from the firm’s IT help desk, and asks them to join a remote support session over Microsoft Teams, Zoom, or Quick Assist. The employee, trying to be helpful, clicks yes. The attacker then copies the files and demands payment to not publish them. No encryption, no ransom note on the screen, no obvious moment where anything looked wrong.

How the Campaign Actually Works

The FBI advisory and follow-on threat intelligence describe three distinct entry methods. Any firm evaluating IT support for law firms should be asking a prospective provider how they defend against each one specifically:

• Callback phishing. A fake subscription or renewal invoice arrives by email — no malicious link, no attachment, nothing a filter will catch. It lists a phone number to dispute the charge. The victim calls the attacker directly.
• Vishing as internal IT. An operator calls staff claiming to be the firm’s own help desk and talks them into installing a legitimate remote access tool. Because the software is legitimate, endpoint protection stays silent.
• Physical intrusion. In the most aggressive variant, operators walk into the office posing as IT contractors and plug USB storage devices directly into workstations to copy data on site.
• Exfiltration, not encryption. Because nothing gets locked, your backups do not save you. The leverage is the threat of publishing privileged client material.
• Supply chain clustering. Victims have clustered in ways that suggest a shared legal technology vendor was compromised upstream, giving attackers several firms through one door.

What Is Actually at Stake for a Las Vegas Firm

Clark County’s legal market is unusually exposed. Personal injury and construction defect practices hold medical records and settlement figures. Gaming and hospitality counsel hold regulatory filings and employment matters. Family law holds financial disclosures. All of it is material an extortionist can price.

• ⚠ Privileged client communications published on a leak site, permanently and searchably
• ⚠ IOLTA and settlement trust account details exposed, feeding follow-on wire fraud against clients
• ⚠ Nevada NRS 603A breach notification obligations triggered across every affected resident
• ⚠ Bar complaints and malpractice exposure from clients whose confidences were not protected
• ⚠ Opposing counsel gaining access to strategy, valuations, and settlement authority
• ⚠ Referral relationships lost — in a market this tightly networked, reputation damage compounds fast

There is also an ethics dimension that has no equivalent in other industries. ABA Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized disclosure of client information. ABA Formal Opinion 483 goes further: it establishes an affirmative duty to monitor for breaches, to stop unauthorized access, to restore system integrity, and to notify affected current clients. Critically, the opinion treats incident response planning as part of “reasonable efforts” — meaning the absence of a written plan is not merely a business risk. It is a defensible allegation of a rules violation.

Three Fixes That Actually Stop This Attack

What Managed IT Services for Law Firms Should Include

If you are evaluating providers, the differentiator is not price per seat. It is whether the provider understands that a law firm’s threat model is confidentiality first. Encryption-based ransomware is survivable with good backups. Silent extortion is not, because the damage happens the moment the data leaves the building.

Meaningful managed IT services for law firms should cover identity and multi-factor authentication that resists help-desk social engineering, endpoint detection tuned to flag unusual data movement rather than just known malware, documented vendor risk review for your practice management and e-discovery platforms, staff training that specifically rehearses the fake-IT-call scenario, and immutable backups kept separate from your production environment. Ask for all five by name. A provider who cannot speak to vendor risk review has not thought about the supply chain clustering that has already hit firms this year.

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas works with Clark County professional services firms that carry real confidentiality obligations — legal, healthcare, accounting, and the contractors who serve them. We know the difference between a compliance checkbox and a control that actually stops a determined caller at the moment they ask an employee to click “allow.”

If your firm has never tested what happens when someone phones your office claiming to be IT, that test is going to happen eventually. It is worth choosing whether it happens on your terms or theirs.