24 Law Firms, 10 Listed, 14 Paid
SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms in a March 2026 campaign, each hosted on one of two IP addresses with its own countdown timer and victim-specific branding. Cross-referencing the 24 firms against INC’s leak site shows 10 (41.67%) listed and 14 (58.33%) not listed — a higher non-listing rate than typical ransomware clusters, consistent with most victims resolving the incident via payment or a negotiated partial arrangement rather than a public leak.
The Extortion Pages
Each of the 24 pages is a dedicated HTML template built for a specific US law firm, with its own branding, contact details, and countdown timer. SOCRadar assesses with high confidence that the pages are tied to INC Ransom based on content and infrastructure overlap.
The pages went offline around the time the campaign became public and are no longer reachable. That timing is typical for INC, which pulls the sites once the campaign is public to prevent victims from screenshotting or archiving them before they pay.
The Payment Signal
Cross-referencing the 24 firms against INC’s leak site yields a clean split: 10 (41.67%) are listed, 14 (58.33%) are not. That non-listing rate sits above what we typically see across ransomware clusters, where the majority of victims end up on the DLS after a missed deadline. Here, more than half resolved the incident in a way that kept them off the site — payment, a negotiated partial arrangement, or an outcome we can’t see from the outside.
It’s still an absence, not a confirmation. But it’s a more direct payment-adjacent signal than most ransomware reporting gets to work with, because this cluster hands us a matched set of victims to check one by one.
Why It Matters
The 58% non-listing rate is the tell. Across typical ransomware clusters, the majority of victims end up on the DLS after a missed deadline, which means the not-listed share usually sits in the low-to-mid 40s. Here, 14 of 24 firms stayed off the site — a rate that points to a deliberate resolution path rather than a missed window. That’s a stronger payment-adjacent signal than most ransomware reporting gets to work with, because this cluster hands us a matched set of victims to check one by one.
The tactic is aimed at the victim’s client base. INC didn’t just encrypt the law firm and wait for the IT team to pay; it emailed the firm’s own clients with a dedicated HTML page, complete with countdown timer and victim-specific branding. That’s the people a law firm depends on most to trust them with privileged matters, and it’s what makes the pressure work. The page is built for the client, not the firm’s internal staff.
That’s a strong incentive for other affiliates to copy the pattern against any client-facing profession. Accounting, healthcare, and financial advisory all have the same client-facing surface and the same reputational risk. If the law firm’s clients get a dedicated page with a countdown, the accounting firm’s clients will want one too. Expect to see this tactic spread across the next few months as affiliates start working the same client-facing verticals.
Key points
- SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, hosted across two IP addresses.
- Cross-referencing the 24 firms against INC's leak site shows 10 of 24 (41.67%) listed and 14 of 24 (58.33%) not listed.
- The 58% not-listed rate implies those firms paid, negotiated a partial deal, or resolved the incident without a public leak.
- Each page is a dedicated HTML page with a countdown timer, built for a specific US law firm and likely shared with the firm's clients to pressure payment.
- All 24 pages went offline around the time the campaign went public and are no longer reachable.
Further reading & sources
- INC Ransom's Law Firm Extortion: %58 Paid? — SOC Radar
- Ongoing Targeted Campaign Against US Law Firms | Google Cloud Blog
- Dark Web Profile: Silent Ransom Group (LeakedData)
- Resecurity | Silent Ransom Group (SRG): Uncovering DNS Fast Flux Infrastructure
- BianLian ransomware gang shifts focus to pure data extortion
- Industrial Ransomware Analysis for Q2 2026
- Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs
- Sicarii Ransomware Encryption Key Handling Defect
- FBI disrupts the Dispossessor ransomware operation, seizes servers