Silent Ransom Group Ransomware Decryption & Data Recovery

Silent Ransom Group has been active since at least March 2022, coinciding with the collapse of the Conti syndicate. Its operators had previously run BazarCall-style callback phishing to hand initial access to Ryuk and Conti; once Conti shut down they broke away, dropped the encryption payload entirely and kept only data theft and exposure extortion. Note that while Mandiant and others place the crew in the Conti lineage, Unit 42's 2022 reporting explicitly declined to confirm that tie. Mandiant tracks the same cluster as UNC3753 and CrowdStrike calls it Chatty Spider; FBI advisories list SRG, Luna Moth, Chatty Spider and UNC3753 together as one actor.

The tradecraft has shifted three times.

• 2022 to early 2025. Callback phishing built on fake subscription renewals and invoices; the mail carried only a PDF and a call-centre number, and the FBI notes the "subscription fees" were deliberately small so victims were less likely to grow suspicious.
• From spring 2025. Calling staff directly while posing as the victim's own IT helpdesk, using "a security issue" or "a data migration" as the pretext to open a screen-sharing session. Targets are not executives but employees at every level listed on the company website.
• From April 2025, first reported by the FBI in May 2025 and restated in May 2026. Where remote social engineering fails, the crew sends someone to the victim's office claiming they must "image the device" or "create local backups", and copies data straight to removable storage.

Scale and targeting. Ransomware.live records roughly 145 organisations named on the clearnet leak site, about 114 of them in the United States - close to eight in ten - with professional services (law firms foremost) ahead of financial services. FBI advisories add insurance and healthcare victims and state that the crew has consistently targeted US law firms since spring 2023. Between January and May 2026 Mandiant traced dozens of US professional, legal and financial services organisations breached in a single wave. The FBI issued two dedicated products on the same crew within a year - a PIN on 23 May 2025 and a FLASH on 26 May 2026 - which is unusual. As of early September 2026 the leak site was still being updated, most recently on 4 September.

Public reporting has referred to a victim law firm paying a large suppression sum, but no figure has been confirmed by the victim or by law enforcement, so this page does not adopt one. For scale, reporting around the FBI's 2025 advisory put demands in the single-digit millions - not the double-digit range.

A naming note. SRG is not a "ransomware virus" and has no encryptor sample to analyse. Its helpdesk-impersonation playbook resembles Scattered Spider's, but they are different groups and their indicators should not be applied interchangeably.

There is no extension and no note file on disk, so identifying this family by its suffix does not apply. Files still open normally, and most victims only learn what happened when the extortion mail arrives. Six verifiable surfaces remain:

• Mail. Invoice or subscription-themed messages from consumer mailboxes, short and sometimes misspelt, carrying no links and no attachments; their only job is to set up the call that follows.
• Domains. Helpdesk lookalikes closely matching the company name, shaped as <org>-itdesk or <org>-helpdesk.
• Endpoint. Unauthorised remote-tool sessions appearing within a short window - AnyDesk, Zoho Assist, RustDesk, Bomgar, SuperOps, Syncro, Splashtop, Atera - or abuse of Quick Assist, Teams and Terminal Services. The characteristic install is curl fetching an MSI followed by msiexec /quiet.
• Exfiltration. Portable WinSCP, renamed or hidden Rclone, uploads to Google Drive, OneDrive and similar cloud storage, and files mailed out from the employee's own mailbox; sustained outbound traffic on port 22 is a strong signal.
• Extortion. Mail subjects along the lines of "<Company> has lost confidential data of their clients", a three-day deadline, threats to notify staff and clients and to publish on the leak site, then phone pressure.
• Physical. A visitor claiming to be IT support asks to "image the device" or "create local backups" and plugs in removable storage.

Because the chain uses legitimate tooling and drops no conventional malware, static EDR detection is poor. What works is a composite signal: an unexpected RMM install, plus bulk document access in a short window, plus heavy egress.

SRG's entry point is people, not vulnerabilities. It barely bothers with privilege escalation or estate-wide lateral movement: one ordinary employee's endpoint with access to the document store is enough.

Voice phishing is the main line. A harmless invoice-themed email sets up the topic, then the "IT helpdesk" calls, citing a security alert or a data migration, and asks the employee to join a screen share. The session tools are ones the company already uses - Teams, Zoom, Quick Assist, Terminal Services - so nothing looks out of place; one documented intrusion involved five calls with the same target over three days. Once trust is established, installation commands arrive through a burn-after-reading link such as Privnote, landing an AnyDesk, Zoho Assist, Bomgar or SuperOps agent as a stable channel.

One route around endpoint control deserves separate attention. Operators open the session on the employee's personal laptop, then use that unmanaged BYOD device to reach the corporate Windows 365 or Citrix virtual desktop, stepping past the application controls and auditing that live on company-owned endpoints.

The physical vector appeared in 2025 and was restated by the FBI in 2026. Where remote persuasion fails, the crew sends someone to the office, claims the device needs imaging, gains hands-on access and copies data to removable storage. The tactic exploits the gap between cybersecurity and physical security: colleagues rarely verify a work order, and IT never learns anyone visited.

The tempo is fast. From first contact to exfiltration and extortion mail the chain often completes inside one business day; searching, staging and transfer have been observed finishing in under an hour, with the extortion mail sent within thirty minutes. A rhythm of "raise it at next week's security meeting" cannot keep up.

SRG does not encrypt anything, so this section covers what it actually does: targeted search and bulk transfer. (An associated cluster deployed a LOCKBIT.BLACK payload back in 2022; the crew has since moved entirely to theft-only operations.)

Search. After landing on an endpoint the operator enumerates local directories, mapped network drives and active OneDrive folders. In law-firm intrusions they use the keyword search built into document systems such as iManage to find sensitive matters directly - all under the victim employee's own legitimate permissions, so the audit log simply shows that person browsing files. Target data clusters around W-2, W-9 and 1099 tax forms, audit files, client agreements and HR material containing Social Security numbers; for law firms what leaves is typically matter material covered by attorney-client privilege.

Staging and transfer. Files are collected into the user's Downloads folder or Roaming profile path, then take one of three routes: drag-and-drop upload into attacker-controlled consumer file sharing accounts, with folders renamed to the victim's brand; SFTP transfer with portable WinSCP or Rclone, the fallback when browser uploads are blocked; or mailing files out from the victim's own mailbox. Volumes range from one or two gigabytes to hundreds - one documented case moved 1.7 GB out of OneDrive, then a further 14.4 GB by WinSCP from a virtual desktop session.

What this means for defenders. There is no encryption process, no shadow-copy deletion and no service stoppage, so conventional ransomware behaviour rules never fire. The monitoring that works sits on the data and network side: bulk-download alerts in document systems, unusual SFTP and cloud storage API traffic, and unapproved RMM installation events.