{
  "slug": "silentransomgroup",
  "group": "silentransomgroup",
  "name": "Silent Ransom Group",
  "note": null,
  "attck": [],
  "activity": {
    "postings": 76,
    "first": "2026-08-12",
    "last": "2026-11-07",
    "countries": {
      "US": 23,
      "??": 51,
      "DE": 2
    },
    "sectors": {
      "services": 30,
      "unknown": 46
    },
    "recent": [
      {
        "date": "2026-11-07",
        "name": "Benesch Law",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/QmVuZXNjaCBMYXdAU2lsZW50UmFuc29tR3JvdXA"
      },
      {
        "date": "2026-11-06",
        "name": "Tucker Ellis",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/VHVja2VyIEVsbGlzQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-06",
        "name": "Wachtell, Lipton, Rosen & Katz",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/V2FjaHRlbGwsIExpcHRvbiwgUm9zZW4gJiBLYXR6QFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-06",
        "name": "B... law",
        "country": "??",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/Qi4uLiBsYXdAU2lsZW50UmFuc29tR3JvdXA"
      },
      {
        "date": "2026-11-05",
        "name": "Smith, Gambrell & Russell, LLP",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/U21pdGgsIEdhbWJyZWxsICYgUnVzc2VsbCwgTExQQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-05",
        "name": "W... R...",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Vy4uLiBSLi4uQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-04",
        "name": "K... R...",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Sy4uLiBSLi4uQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-04",
        "name": "W... G...",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Vy4uLiBHLi4uQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-03",
        "name": "G... R...",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Ry4uLiBSLi4uQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-11-02",
        "name": "S... G...",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Uy4uLiBHLi4uQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-10-30",
        "name": "ArentFox Schiff",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/QXJlbnRGb3ggU2NoaWZmQFNpbGVudFJhbnNvbUdyb3Vw"
      },
      {
        "date": "2026-10-30",
        "name": "Moritt Hock & Hamroff LLP",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/TW9yaXR0IEhvY2sgJiBIYW1yb2ZmIExMUEBTaWxlbnRSYW5zb21Hcm91cA"
      }
    ]
  },
  "convergences": [
    {
      "name": "Troutman Pepper Locke LLP",
      "flagged": "2026-10-31",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Sheppard, Mullin, Richter & Hampton LLP",
      "flagged": "2026-10-06",
      "classes": [
        "leak",
        "litigation",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://www.sygnia.co/blog/investigating-data-extortion-involving-trusted-vendor-access/",
      "publisher": "Sygnia",
      "published": "2026-11-01",
      "title": "Investigating Data Extortion Involving Trusted Vendor Access",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/blog/best-practices-incident-response/",
      "publisher": "Sygnia",
      "published": "2026-10-28",
      "title": "Incident Response Best Practices: Strategies, Tools & Plans",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/threat-reports-and-advisories/php2shell-two-critical-php-vulnerabilities-expose-web-servers-to-remote-code-execution/",
      "publisher": "Sygnia",
      "published": "2026-10-22",
      "title": "php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.guidepointsecurity.com/blog/silent-ransom-group-leaked-chats/",
      "publisher": "GuidePoint GRIT",
      "published": "2026-10-15",
      "title": "Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/press-release/sygnia-expands-global-mdr-operations-austin-singapore-soc-hubs/",
      "publisher": "Sygnia",
      "published": "2026-10-11",
      "title": "Sygnia Unveils Security Operations Center Hubs and Expands AI-Powered Cybersecurity Capabilities To Challenge Threat Attack Rise",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/",
      "publisher": "Sygnia",
      "published": "2026-09-28",
      "title": "Actively Exploited NetScaler Vulnerabilities",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/blog/when-it-support-is-the-attack-how-law-firms-can-defend-against-silent-ransom-group/",
      "publisher": "Sygnia",
      "published": "2026-09-22",
      "title": "When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/webinars/how-law-firms-can-defend-against-silent-ransom-group/",
      "publisher": "Sygnia",
      "published": "2026-09-17",
      "title": "When IT Support Is the Attack: Defending Law Firms Against Silent Ransom Group",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/blog/shai-hulud-in-the-wild-what-security-and-incident-response-teams-need-to-know/",
      "publisher": "Sygnia",
      "published": "2026-09-06",
      "title": "Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/blog/how-the-safepay-ransomware-group-abused-onedrive-to-steal-data/",
      "publisher": "Sygnia",
      "published": "2026-08-31",
      "title": "Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data",
      "origin": "feed",
      "primary": true
    }
  ],
  "techniques": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactics": [
        "collection"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1052.001",
      "name": "Exfiltration over USB",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactics": [
        "lateral-movement",
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    },
    {
      "id": "T1199",
      "name": "Trusted Relationship",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    },
    {
      "id": "T1200",
      "name": "Hardware Additions",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 3,
      "related": 0
    },
    {
      "id": "T1219",
      "name": "Remote Access Tools",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [
        "t1505-003-peoplesoft-psemhub-webshell-drop"
      ],
      "community": 6,
      "related": 46
    },
    {
      "id": "T1566.004",
      "name": "Spearphishing Voice",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [
        "t1583-001-claims-registration-conjunction"
      ],
      "community": 0,
      "related": 14
    },
    {
      "id": "T1567.002",
      "name": "Exfiltration to Cloud Storage",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 12
    },
    {
      "id": "T1583.001",
      "name": "Domains",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [
        "t1583-001-claims-registration-conjunction"
      ],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1585.003",
      "name": "Cloud Accounts",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1589.002",
      "name": "Email Addresses",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 1,
      "related": 2
    },
    {
      "id": "T1589.003",
      "name": "Employee Names",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 2
    },
    {
      "id": "T1591.004",
      "name": "Identify Roles",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 2,
      "related": 0
    },
    {
      "id": "T1593.001",
      "name": "Social Media",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1650",
      "name": "Acquire Access",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1656",
      "name": "T1656",
      "tactics": [],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1657",
      "name": "Financial Theft",
      "tactics": [
        "impact"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1684",
      "name": "Social Engineering",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1684.001",
      "name": "Impersonation",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    }
  ],
  "cves": [
    {
      "id": "CVE-2021-44228",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.99999,
      "vendor": "Apache",
      "product": "Log4j2"
    },
    {
      "id": "CVE-2024-20399",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.04306,
      "vendor": "Cisco",
      "product": "NX-OS"
    },
    {
      "id": "CVE-2026-109618",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.99999,
      "vendor": "PHP Group",
      "product": "PHP"
    },
    {
      "id": "CVE-2026-109619",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.99999,
      "vendor": "PHP Group",
      "product": "PHP"
    },
    {
      "id": "CVE-2026-88771",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.81894,
      "vendor": "Citrix",
      "product": "NetScaler"
    },
    {
      "id": "CVE-2026-88772",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.76566,
      "vendor": "Citrix",
      "product": "NetScaler"
    },
    {
      "id": "CVE-2026-88773",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.03081,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2026-88774",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.00395,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2026-88775",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.00719,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2026-88776",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.00734,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2026-88777",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.00719,
      "vendor": null,
      "product": null
    },
    {
      "id": "CVE-2026-88778",
      "in_kev": false,
      "ransomware_use": false,
      "epss": 0.00694,
      "vendor": null,
      "product": null
    }
  ],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 19,
    "defendable": 12,
    "covered": 7,
    "uncovered": [
      "T1052.001",
      "T1656",
      "T1657",
      "T1684",
      "T1684.001"
    ]
  }
}