eSentire’s threat response team recorded a 20% increase in legal-sector incidents in 2025. Meanwhile, American Bar Association survey data shows only 34% of law firms have a formal incident response plan. Attacks on firms are growing faster than firms are preparing for them.
The attack that should worry managing partners most does not arrive in an inbox. It arrives as a phone call from someone who says they work in IT.
The call
On May 26, 2026, the FBI issued a FLASH alert on Silent Ransom Group, also tracked as Luna Moth, Chatty Spider and UNC3753. The group has consistently targeted US-based law firms since spring 2023, and Mandiant followed in June with a report on an ongoing campaign against the sector.
The playbook is simple:
- The pretext. A caller, or an email that prompts a callback, poses as the firm’s IT support. Sometimes the hook is a fake invoice or a subscription that needs to be canceled.
- The access. The employee is walked through installing a legitimate remote-access tool, such as Zoho Assist, AnyDesk or Microsoft Quick Assist.
- The theft. The attacker quietly copies files out with ordinary tools like WinSCP or Rclone. When the phone pitch fails, the FBI reports the group has sent someone in person to plug in a storage device.
- The extortion. There is no encryption and no ransom note on the screen. Instead, the firm, its employees and its clients get calls threatening to publish the data.
There is no malware and no zero-day anywhere in that list. Every step depends on an employee trying to help someone who sounds like a colleague.
Why law firms
Law firms hold some of the most sensitive data any organization keeps: merger plans, litigation strategy, intellectual property, personal client records. That makes them valuable to steal and painful to have exposed. An attacker does not need to lock a single file when the threat of publishing it is leverage enough.
The business model compounds the risk. A firm’s reputation is built on confidentiality, so a breach quickly becomes a client relationship problem, and increasingly a legal one. Firms are already facing class actions after data incidents.
Then there is the culture. Firms run on responsiveness. Associates, paralegals and assistants are trained to move quickly for partners and clients, and a polite, urgent caller from “IT” fits right into that rhythm. Attackers are counting on the same service mindset that makes a firm good at its job.
Email has not gone away
None of this means the inbox is safe. eSentire found that adversary-in-the-middle phishing, where a fake login page relays your password and your MFA code to the attacker in real time, was the most common way into the law firms it investigated, at 28.57% of initial access events. Credential and identity-focused activity made up 56.3% of the legal-sector threats it saw in 2025.
The common thread across both channels is identity. Whether the lure is a fake Microsoft 365 page or a friendly voice from “the help desk,” the attacker’s goal is the same: get a real person to hand over access. MFA helps, but a person who reads a passcode aloud or approves a remote session on request has just walked the attacker around it.
What firms should do now
Most of the defenses here are changes to process and behavior, not new tools. A few places to start:
- Tell everyone what real IT looks like. Employees should know exactly how IT will and will not contact them. If IT never calls unprompted to install software, say so, loudly and often.
- Make “hang up and call back” the norm. Verification through a known number should be expected, not awkward. Partners need to model it, or no one else will.
- Lock down remote access tools. Inventory which remote monitoring and management tools are approved, and block or alert on the rest. The FBI’s indicator list is a good place to begin.
- Move to phishing-resistant MFA. FIDO2 keys and passkeys shut down the fake-login-page problem that one-time codes cannot.
- Test the phone, not just the inbox. Most firms have years of email phishing data and nothing on how their people respond to a convincing call. That gap is where this campaign operates.
- Have the plan before you need it. If two-thirds of firms lack a formal incident response plan, an extortion call to your clients is the wrong moment to write one.
The real question
Law firms have spent years training people to spot a suspicious email. The real question is whether those same people would hang up on a calm, credible voice asking for five minutes of screen-sharing. For many firms, the honest answer is that nobody knows, because nobody has tested it.
Want to know how your people handle a call from “IT”? Book a vishing demo and we’ll run a live, authorized AI voice call against your help desk or front desk lines, so you get a pass/fail result and a transcript instead of a guess.
Watch Tim Chase, AVP Cybersecurity, take a live call from an AI attacker and see how SSO verification codes stop vishing attacks before access is handed over.