<\/p>\n
The FBI has issued a specific warning about a criminal group that calls attorneys, pretends to be their IT department, and walks out with the client file.<\/p>\n
Published by CMIT Solutions of Las Vegas · Cybersecurity · 6 min read<\/p>\n<\/div>\n
Most law firms in Clark County think about cybersecurity the way they think about fire suppression — a compliance box, handled by the building. That assumption is now dangerous. The legal industry is not being caught in the blast radius of attacks aimed at someone else. It is being deliberately and specifically hunted<\/strong>, by a group the FBI has publicly named.<\/p>\n The group is Silent Ransom Group<\/strong>, also tracked as Luna Moth<\/strong>, Chatty Spider<\/strong>, and UNC3753<\/strong>. It has been working US law firms since spring 2023, and it escalated sharply through 2025 and into 2026. The FBI issued a FLASH advisory describing the method in detail, because the method is unusually effective and requires almost no technical sophistication to pull off.<\/p>\n Here is what makes it different: there is often no malware at all.<\/strong> An operator simply telephones an attorney or a paralegal, says they are from the firm’s IT help desk, and asks them to join a remote support session over Microsoft Teams, Zoom, or Quick Assist. The employee, trying to be helpful, clicks yes. The attacker then copies the files and demands payment to not publish them. No encryption, no ransom note on the screen, no obvious moment where anything looked wrong.<\/p>\n Security researchers tracked more than 200 ransomware and extortion incidents against law firms between 2025 and early 2026. Ransom demands against legal and professional services firms have ranged from roughly $500,000 to $21 million, with the average sitting just under $2 million. INC Ransom alone has claimed more than 20 law firms and legal services organizations in 2026.<\/p>\n<\/div>\n The FBI advisory and follow-on threat intelligence describe three distinct entry methods. Any firm evaluating IT support for law firms<\/strong> should be asking a prospective provider how they defend against each one specifically:<\/p>\n Clark County’s legal market is unusually exposed. Personal injury and construction defect practices hold medical records and settlement figures. Gaming and hospitality counsel hold regulatory filings and employment matters. Family law holds financial disclosures. All of it is material an extortionist can price.<\/p>\n There is also an ethics dimension that has no equivalent in other industries. ABA Model Rule 1.6(c)<\/strong> requires lawyers to make reasonable efforts to prevent unauthorized disclosure of client information. ABA Formal Opinion 483<\/strong> goes further: it establishes an affirmative duty to monitor for breaches, to stop unauthorized access, to restore system integrity, and to notify affected current clients. Critically, the opinion treats incident response planning as part of “reasonable efforts” — meaning the absence of a written plan is not merely a business risk. It is a defensible allegation of a rules violation.<\/p>\n The Gap<\/span>At most small and mid-sized firms, staff have no way to confirm who their IT provider actually is. If a voice on the phone sounds competent and uses the right vocabulary, they get access. That is the entire attack.<\/p>\n The Fix<\/span>Publish one support number and one support email, post them physically at every desk, and make it firm policy that nobody grants a remote session to an inbound call<\/strong>. Staff hang up and dial the posted number. Extend the same rule to anyone who appears in the office claiming to be a technician — badge check, no exceptions, escorted at all times.<\/p>\n<\/div>\n The Gap<\/span>Antivirus will not flag Quick Assist, AnyDesk, or a legitimate Zoom screen share, because none of those are malicious. The tooling the attacker uses is the same tooling your real IT team uses.<\/p>\n The Fix<\/span>Application allow-listing. Approve exactly one remote support agent and block the rest at the device level, so an employee who is being socially engineered cannot<\/em> complete the install even if they want to. Pair it with alerting on large outbound data transfers, since exfiltration is the whole point of this campaign.<\/p>\n<\/div>\n The Gap<\/span>Firms discover their notification obligations during the breach, when the managing partner is trying to determine which clients were affected and no one can answer. Under Opinion 483, that improvisation is itself the problem.<\/p>\n The Fix<\/span>A written plan naming who declares an incident, who contacts the carrier, who drafts client notice, and who talks to the Nevada bar if required. Keep logging turned on and retained long enough to answer “what did they take” — without logs, you must assume everything was taken and notify accordingly.<\/p>\n<\/div>\n A thirty-minute review will tell you whether your firm can survive a phone call from someone pretending to be your IT department.<\/p>\n Request a Security Review<\/a>\n<\/div>\n If you are evaluating providers, the differentiator is not price per seat. It is whether the provider understands that a law firm’s threat model is confidentiality first<\/strong>. Encryption-based ransomware is survivable with good backups. Silent extortion is not, because the damage happens the moment the data leaves the building.<\/p>\n Meaningful managed IT services for law firms<\/strong> should cover identity and multi-factor authentication that resists help-desk social engineering, endpoint detection tuned to flag unusual data movement rather than just known malware, documented vendor risk review for your practice management and e-discovery platforms, staff training that specifically rehearses the fake-IT-call scenario, and immutable backups kept separate from your production environment. Ask for all five by name. A provider who cannot speak to vendor risk review has not thought about the supply chain clustering that has already hit firms this year.<\/p>\n CMIT Solutions of Las Vegas works with Clark County professional services firms that carry real confidentiality obligations — legal, healthcare, accounting, and the contractors who serve them. We know the difference between a compliance checkbox and a control that actually stops a determined caller at the moment they ask an employee to click “allow.”<\/p>\n If your firm has never tested what happens when someone phones your office claiming to be IT, that test is going to happen eventually. It is worth choosing whether it happens on your terms or theirs.<\/p>\n Local IT support and cybersecurity built for firms that cannot afford a confidentiality failure. Serving Las Vegas, Henderson, North Las Vegas, and Clark County.<\/p>\nHow the Campaign Actually Works<\/h2>\n
\n
What Is Actually at Stake for a Las Vegas Firm<\/h2>\n
\n
Three Fixes That Actually Stop This Attack<\/h2>\n
• Establish a verified callback rule for anyone claiming to be IT<\/h3>\n
• Block unapproved remote access tools at the endpoint<\/h3>\n
• Write the incident response plan before you need it<\/h3>\n
Las Vegas Businesses: Don’t Wait for the Breach.<\/h3>\n
What Managed IT Services for Law Firms Should Include<\/h2>\n
Defending Las Vegas with CMIT Solutions<\/h2>\n
\n• FBI IC3 FLASH Advisory — Silent Ransom Group Impersonating IT Personnel Through Social Engineering<\/a>
\n• BleepingComputer — Silent Ransom Group Targets Law Firms With Fake IT Support Calls<\/a>
\n• ABA Formal Opinion 483 — Lawyers’ Obligations After an Electronic Data Breach<\/a>\n<\/div>\nProtect Your Las Vegas Business Today<\/h2>\n