The FBI Named The Method In May. The Leak Site Filled Up In October.

On 26 May 2026 the FBI published a FLASH advisory naming a single extortion crew, the sector it was working through, and the method it used to get in. The method was a telephone call to the IT helpdesk. Five months later, in the fortnight to 22 October, five named law firms appeared on that same crew's leak site, including two of the largest in the world. Every listing is an unverified claim by the attacker. The advisory, however, was free, specific, and published in good time.

What the leak site shows

The actor is tracked by Mandiant as UNC3753 and more widely as Silent Ransom Group, Luna Moth or Chatty Spider. It has been active since at least 2022. It does not encrypt systems. It takes files and threatens to publish them, and it has its own leak site for the purpose.

The following entries are drawn from the public victim feed at ransomware.live, which mirrors the actor's own leak site. The dates and times are the feed's discovery timestamps, in UTC.

• 26 May 2026The FBI issues FLASH-20260526-01, "Silent Ransom Group Impersonating IT Personnel through Social Engineering". It records law firm targeting going back to spring 2023.
• 5 June 2026Mandiant and Google Threat Intelligence publish "Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms", covering activity from January to May 2026 across dozens of organisations in legal, financial and professional services. It names no victims.
• 6 and 8 OctoberAndersen Group, a tax and advisory firm, is listed twice. Baker McKenzie and O'Hagan Meyer follow on 8 October.
• 19 October, 13:25Latham & Watkins is listed.
• 21 October, 19:03Porter Hedges LLP is listed.
• 22 October, 16:58Kirkland & Ellis LLP is listed. One minute later a redacted entry appears with a countdown timer running.

None of these firms has commented publicly, and at the time of writing no mainstream security outlet or legal trade title has reported any of the October listings. The only sites carrying them are automated scrapers republishing the same leak-site data. That absence matters in both directions: there is no confirmation, and there is also no denial.

Several of this actor's entries carry deliberately redacted victim names, rendered as fragments such as "P...S...R...". Decoding those into named firms is guesswork, and we have not attempted it.

Why this one is different

There is no vulnerability in this story. No CVE, no CVSS score, no emergency patch, nothing for a vulnerability management programme to act on. The documented entry method is a conversation.

Mandiant's account of the chain is unusually detailed, and worth reading in full. The actor first sends a plain, unremarkable email from a consumer account, referring to an invoice, often with a deliberate spelling mistake. Mandiant quotes one: "hello, here is the invcoie we talked about yesterday". The email carries no malware and no link worth blocking. Its purpose is to make the recipient uneasy enough to welcome a call from IT.

The call follows. The caller presents as internal IT or security, with a pretext about a data migration or that invoice. The target is then persuaded to join a screen-sharing session over Zoom, Teams, Quick Assist or Microsoft Terminal Services, and from there a commercial remote management agent is installed: Mandiant names AnyDesk, Bomgar and Zoho Assist, and documents an attempted SuperOps installation delivered by a single command line. Installation links are sent through Privnote, which destroys the message after reading and leaves little for an investigator to recover.

What happens next is the part that should concern any professional services firm. The actor searches the document management system directly. Mandiant records keyword searches in iManage for client agreements, audit files, and US tax forms. Data leaves by portable WinSCP or Rclone, by browser upload to consumer file-sharing accounts, and in one documented case as 1.7 GB to a cloud drive followed by a further 14.4 GB over WinSCP from a virtual desktop session. The actor also pivots from personal laptops into corporate virtual desktops, which is a route that exists precisely because the firm permitted it.

The FBI advisory adds a step Mandiant stops short of formally attributing: where remote access fails, a person attends the office, presents as an IT technician, and copies files to a storage device while explaining that the machine needs to be imaged.

The timings are what make this hard to interrupt. Mandiant records many intrusions running from first contact to data theft and extortion inside a single business day, with the extortion email often arriving within 30 minutes of the actor leaving the environment, and three days given to respond. Not every case moves that fast, and the same report describes one intrusion involving five calls over three days. But a control that depends on a weekly review will not engage at all.

If the firm does not pay, the actor's stated practice is to contact employees and external clients directly. For a law firm, that is the whole of the risk in one sentence. The commercial damage is not the downtime. It is a client learning about the incident from the criminal.

The same firm, three routes, three years

Kirkland & Ellis is worth examining not because this latest claim is proven, but because its public history shows how little the entry route matters to the outcome.

In 2023 the firm was among those affected by the Cl0p group's mass exploitation of the MOVEit file transfer tool, alongside K&L Gates and Proskauer Rose, and a class action followed in June 2024. On 23 September 2026 a listing for the firm appeared on Cl0p's leak site again, during that group's long-running campaign against Oracle E-Business Suite. On 22 October 2026 it appeared on Silent Ransom Group's. The 2023 incident is a matter of record. The two 2026 listings are unverified actor claims.

Three years, three different routes in, and in two of the three the route was not the firm's own software at all. A supplier's file transfer product, then an enterprise application, then a phone call. The common factor is the value of what the firm holds, which is why it keeps being approached.

A caution on sources here, because it caught us. Two aggregator sites, ctiwatch and darkfield, carry pages on these Kirkland listings. One of them attributes the activity to "elf.cyclops_blink" and describes it as a ransomware group. Cyclops Blink is router malware attributed to Russian military intelligence and has nothing to do with any of this. Both sites publish machine-written company profiles and copy attack dates from listing dates. They are derivative scrapers, and a briefing built on them would inherit their errors.

The commercial exposure for UK organisations

Three of the firms named above maintain substantial London offices, which is where this stops being an American story. Nothing in any of the leak-site entries indicates which offices or which jurisdictions are involved, so everything below is conditional on facts not currently in evidence.

Regulatory

Kirkland & Ellis International LLP is a recognised body on the Solicitors Regulation Authority register, SRA number 349107, authorised since 1 November 2011, with a head office in the City of London. If UK personal data processed in the context of that establishment were affected, UK GDPR would be engaged and the ICO would have jurisdiction, with the Article 33 notification duty following. The SRA would expect to hear about a material incident as well. None of that has been reported in this case, and we are not suggesting it has occurred. The point for a general counsel is narrower: a US-headquartered firm with a London practice carries UK regulatory exposure that does not depend on where its servers sit.

Financial

This model needs no encryption, so the usual recovery cost model does not apply. There is no restore to perform and no ransom framed as a decryption key. The cost sits in legal review of what was taken, notification, client remediation, and the commercial consequence of clients being contacted directly.

Contractual

For most organisations the exposure here is somebody else's incident. Outside counsel holds material that is more sensitive than anything in the organisation's own systems: transaction documents before announcement, litigation strategy, regulatory correspondence, investigation findings, patent filings. That data sits under a retainer and a confidentiality clause, both of which allocate blame after the event rather than preventing it.

Third-party assurance as commonly practised does not reach this. A questionnaire asks whether the supplier holds ISO 27001, patches on a schedule, and runs multi-factor authentication. Each of those can be answered yes by a firm whose helpdesk will still reset a password for a convincing caller. The control that failed in the documented cases is not on the questionnaire.

Governance

Helpdesk identity verification rarely has a named owner at board level. It is treated as a service desk procedure rather than a control, so it is not tested, not reported on, and not in anybody's risk appetite statement. That is the governance gap this actor monetises.

What leaders should do now

None of these is a patching task. All five are decisions an executive can take this week.

1. Set and publish a verification standard for IT-initiated contact. Decide how an employee confirms that a caller claiming to be IT is IT, make it a rule that applies to everyone including partners and the executive, and tell staff plainly that refusing a caller will never be held against them. The FBI and Mandiant both put strict verification procedures first.

2. Decide which remote access tools are permitted, and block the rest by default. The documented chain depends on installing a legitimate remote management agent. An allow-list of the two or three the organisation actually uses removes the step entirely. This is a decision about standardisation, not a technical obstacle.

3. Put the document management system under egress monitoring. If keyword searches across client files, followed by a bulk read, do not generate an alert, the most valuable system in a professional services firm is also the least watched. Ask for the alerting rule in writing.

4. Add the helpdesk to the third-party assurance questionnaire. Ask outside counsel and other professional suppliers one question: how does your service desk verify identity before granting access or resetting credentials? The answer is short, and it is more informative than the certificate.

5. Rehearse the client notification path before it is needed. If the actor's practice is to contact clients directly, the organisation's first communication cannot be its second. Decide now who speaks to clients, how quickly, and with what holding position while facts are established.

Three questions for leadership

How does our service desk prove to an employee that it is our service desk? If the answer is caller ID or an internal number, it is not a control.

Which of our professional advisers holds material that would damage us more than our own systems being breached, and when did we last ask any of them about their helpdesk?

If a criminal contacted our largest client about our data before we did, who would be accountable for that sequence?

The strategic takeaway

The useful fact in this story is not that a large law firm has been named on a leak site. It is that the warning was issued first, by a law enforcement agency, naming the actor, the sector and the method, with the defensive recommendations attached, at no cost, in May.

Specific public warnings are the cheapest intelligence any organisation will ever receive, and they are routinely read as news rather than as a prompt to change a control. The reason is structural: an advisory about a telephone call does not route to anyone. It is not a patch, so it does not reach vulnerability management. It is not a product, so no vendor follows up. It describes a procedure owned by a service desk that does not report to the board.

That is the gap worth closing, and it is a governance question rather than a security one. The organisations that will not feature in the next five listings are the ones that treated a May advisory as a decision to be taken rather than an article to be read.

Confidence note

Confirmed. The FBI published FLASH-20260526-01 on 26 May 2026 concerning Silent Ransom Group and the legal sector. Mandiant and Google Threat Intelligence published "Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms" on 5 June 2026, covering January to May 2026, naming no victims. The TTPs and timings described above are drawn from those two sources. Leak-site entries for Andersen Group, Baker McKenzie, O'Hagan Meyer, Latham & Watkins, Porter Hedges and Kirkland & Ellis appear in the public victim feed on the dates given. Kirkland & Ellis International LLP is an SRA-recognised body, number 349107. Kirkland & Ellis, K&L Gates and Proskauer Rose were affected by the 2023 Cl0p exploitation of MOVEit, and a class action against Kirkland followed in June 2024.

Assessed. That the October listings and the May advisory describe the same activity, on the basis of actor identity and the sector pattern. That the physical-intrusion element belongs to this actor: the FBI states it, while Mandiant assesses the linked incidents as likely but does not formally attribute them. Kirkland's reported revenue of $10.56bn and profits per equity partner of $11.1m for 2025 come from Bloomberg Law and The American Lawyer reporting of March 2026, not from the firm, which does not publish its financials.

Not known. Whether any of the October listings reflects an actual compromise. What data, if any, was taken from any named firm. Whether any UK office, UK personal data or UK client is involved in any of them. Whether any regulator has been notified. No named firm has commented, and no independent reporting of the October listings exists at the time of publication. A leak-site listing is a criminal's marketing claim, and claims of this kind are sometimes recycled, exaggerated or simply false.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification and specialist technology recruitment as one integrated capability for organisations in the UK, EU and Americas. We are a young firm and we publish our own research. Founded by Jonathan Garzon, whose career was spent selling cybersecurity, compliance and technology to security and technology buyers.