The Call From IT That Wasn't

In May 2025, the FBI warned that a criminal group it calls the Silent Ransom Group was targeting U.S. law firms. In May 2026, it issued a second alert with more detail. According to the FBI, the group has consistently targeted U.S. law firms since spring 2023.

The method is simple, and that is why it works:

1. A setup email. A fake invoice or subscription charge arrives, sometimes from a free email account.
2. A call from "IT." Someone calls, or asks the employee to call, pretending to be the firm's help desk.
3. A remote session. The employee is talked into starting a support session with a normal tool, such as Microsoft Teams, Zoom or Quick Assist.
4. Quiet data theft. The attacker copies files out, sometimes without needing any special access.
5. Extortion. The firm is told to pay, or the files will be posted or sold.

The 2026 alert adds one more step. When the remote session does not work, the FBI says the group has sent a person to the office to plug a storage drive into a computer.

This is not limited to one group. Fake IT help desk calls are now one of the most common ways criminals get in, according to the FBI, the federal Cybersecurity and Infrastructure Security Agency (CISA), Microsoft, Google's Mandiant security team and the security firm CrowdStrike. Mandiant found that voice phishing became the second most common way attackers got in during 2025. And with AI voice tools, the caller can now sound like someone you actually know.

Criminals go where the leverage is. A small estates, elder law or real estate practice holds exactly the kind of information that makes extortion work: wills and trusts, medical and financial records for older clients, bank details, deeds and closing documents. Many of those clients are older adults, the group the FBI says reports the largest fraud losses.

Small firms also tend to run on trust. Everyone knows everyone. When someone calls and says they are from IT, the instinct is to help. That instinct is the opening.

Most firms think of ransomware as the lockout: files get scrambled, and good backups bring them back. This scheme often skips the lockout entirely. Nothing gets scrambled. The files are simply copied and held over your head.

Backups still matter. But a backup cannot un share a client's medical records. CISA, Mandiant, the FBI and the UK's national cybersecurity agency all describe this shift: more attacks now steal data and threaten to leak it, with or without locking anything.

That changes the job. Recovery is not enough. You have to make the theft hard in the first place.

If someone contacts you claiming to be IT, hang up and call IT back on a number you already have.

Not the number in the email. Not the number the caller gives you. The number on the sticker, in the firm's contact list, or in your IT agreement. Real IT will not mind. A criminal will not be there when you call back.

That single habit can break the scheme at step two. Everything else is backup for the day someone forgets.

These are small, practical and fit a firm with five people or fifty.

1. One known way to reach IT. Put the help desk number and email on every desk and in every phone. Agree on how real IT will reach staff, so anything else stands out.
2. No surprise remote sessions. Online support sessions should only start from a request your staff made, with the one tool your IT provider uses. Block or flag other remote access tools on firm computers.
3. Watch the USB ports. Set computers to block or alert on unknown storage drives. Add a simple office rule: nobody touches a firm computer without being expected and verified, no matter what uniform or badge they have.
4. Stronger sign in where it counts. Use passkeys or security keys (a sign in that cannot be phished the way a password and code can) for email and administrator accounts. Security agencies call these the strongest protection against stolen logins. Normal two step sign in is still far better than none.

Then do a five minute walkthrough with staff. Read them the scenario at the top of this article and ask what they would do. The answer you want is: hang up, call back.

New York Rule of Professional Conduct 1.6(c) says a lawyer must make reasonable efforts to prevent unauthorized access to, or disclosure of, client confidential information. The American Bar Association has gone further in formal opinions on securing client communications (Opinion 477R) and on what lawyers must do after a data breach (Opinion 483), including telling clients when their information is affected.

Nobody expects a small firm to run a full security team. But when the FBI has publicly described the exact attack, a simple callback rule is a reasonable place to start.

We are an IT company, not a law firm. This is not legal advice. Ask your own counsel what applies to you.

We set up these controls for small New York firms and keep them current: one known way to reach support, locked down remote access, USB controls, phishing resistant sign in for the accounts that matter, and short staff training built around this exact scenario. We also write down what is in place, so you have a record ready when a client or an insurer asks.

If you want to know where your firm stands, start with a free 30 minute Technology Readiness Review. We will talk through how your firm really works and leave you with a short list of what is solid and what to fix first.

• FBI, PIN 20250523-001, Silent Ransom Group Targeting Law Firms, May 23, 2025
• FBI, FLASH-20260526-01, Silent Ransom Group Impersonating IT Personnel, May 26, 2026
• CISA and FBI, Advisory AA23-320A, Scattered Spider, updated July 29, 2025
• Microsoft Threat Intelligence, Threat actors misusing Quick Assist in social engineering attacks, May 15, 2024
• Google Mandiant, M Trends 2026, Mar. 23, 2026
• CrowdStrike, 2026 Threat Hunting Report, Aug. 3, 2026
• FBI IC3, PSA I-051525-PSA (AI voice impersonation), May 15, 2025
• CISA, #StopRansomware Guide
• Google Mandiant, Ransomware TTPs in a Shifting Threat Landscape, Mar. 16, 2026
• UK National Cyber Security Centre, What's happened to my data?
• CISA, Implementing Phishing Resistant MFA fact sheet
• FBI IC3, 2025 Internet Crime Report
• New York Rules of Professional Conduct (22 NYCRR Part 1200), Rule 1.6
• ABA Formal Opinion 477R, Securing Communication of Protected Client Information, 2017
• ABA Formal Opinion 483, Lawyers' Obligations After an Electronic Data Breach, 2018
• Full source list and how we check claims