Hunt / silentransomgroup
Silent Ransom Group
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-11-07 | Benesch Law | US |
| 2026-11-06 | Tucker Ellis | US |
| 2026-11-06 | Wachtell, Lipton, Rosen & Katz | US |
| 2026-11-06 | B... law | ?? |
| 2026-11-05 | Smith, Gambrell & Russell, LLP | US |
| 2026-11-05 | W... R... | ?? |
| 2026-11-04 | K... R... | ?? |
| 2026-11-04 | W... G... | ?? |
| 2026-11-03 | G... R... | ?? |
| 2026-11-02 | S... G... | ?? |
| 2026-10-30 | ArentFox Schiff | US |
| 2026-10-30 | Moritt Hock & Hamroff LLP | US |
Latest 12 of 76, from ransomware.live. These are the group's claims.
Confirmed elsewhere
Victims of Silent Ransom Group that a second, independent source also named inside two weeks. How convergence works.
- 2026-10-31 Troutman Pepper Locke LLP leak + notice
- 2026-10-06 Sheppard, Mullin, Richter & Hampton LLP leak + litigation + notice
Reports about them
- 2026-11-01 Sygnia: Investigating Data Extortion Involving Trusted Vendor Access
- 2026-10-28 Sygnia: Incident Response Best Practices: Strategies, Tools & Plans
- 2026-10-22 Sygnia: php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution
- 2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew
- 2026-10-11 Sygnia: Sygnia Unveils Security Operations Center Hubs and Expands AI-Powered Cybersecurity Capabilities To Challenge Threat Attack Rise
- 2026-09-28 Sygnia: Actively Exploited NetScaler Vulnerabilities
- 2026-09-22 Sygnia: When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group
- 2026-09-17 Sygnia: When IT Support Is the Attack: Defending Law Firms Against Silent Ransom Group
- 2026-09-06 Sygnia: Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know
- 2026-08-31 Sygnia: Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data
What they exploit
| CVE | Product | KEV | EPSS |
|---|---|---|---|
| CVE-2021-44228 | Apache Log4j2 | yes, ransomware use | 1.000 |
| CVE-2024-20399 | Cisco NX-OS | yes | 0.043 |
| CVE-2026-109618 | PHP Group PHP | yes | 1.000 |
| CVE-2026-109619 | PHP Group PHP | yes | 1.000 |
| CVE-2026-88771 | Citrix NetScaler | yes | 0.819 |
| CVE-2026-88772 | Citrix NetScaler | yes | 0.766 |
| CVE-2026-88773 | - | no | 0.031 |
| CVE-2026-88774 | - | no | 0.004 |
| CVE-2026-88775 | - | no | 0.007 |
| CVE-2026-88776 | - | no | 0.007 |
| CVE-2026-88777 | - | no | 0.007 |
| CVE-2026-88778 | - | no | 0.007 |
What they do
19 techniques, in kill-chain order. 5 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.
| ID | Technique | SigmaHQ | Status |
|---|---|---|---|
| T1589.002 | Email Addresses | 1 | their side |
| T1589.003 | Employee Names | ~2 | their side |
| T1591.004 | Identify Roles | 2 | their side |
| T1593.001 | Social Media | their side | |
| T1583.001 | Domains | their side | |
| T1585.003 | Cloud Accounts | their side | |
| T1650 | Acquire Access | their side | |
| T1091 | Replication Through Removable Media | 1 | SigmaHQ |
| T1199 | Trusted Relationship | 1 | SigmaHQ |
| T1200 | Hardware Additions | 3 | SigmaHQ |
| T1566.004 | Spearphishing Voice | ~14 | thrunt |
| T1005 | Data from Local System | 14 | SigmaHQ |
| T1219 | Remote Access Tools | 6 | thrunt |
| T1052.001 | Exfiltration over USB | nothing | |
| T1567.002 | Exfiltration to Cloud Storage | 14 | SigmaHQ |
| T1657 | Financial Theft | nothing | |
| T1656 | T1656 | nothing | |
| T1684 | Social Engineering | nothing | |
| T1684.001 | Impersonation | nothing |
SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.
Rules to deploy
Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1505-003-peoplesoft-psemhub-webshell-drop, t1583-001-claims-registration-conjunction.
Sweep
No indicators. Either nobody has published any for Silent Ransom Group, or the reports cite values without marking them as IOCs. package.json