[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fijsn1I6vYKaAhihDOYBzs8ERKE7vIL3Rwi-JAjeIplk":3,"$fOEkVPezdl7i2WkUFgRenQaRljtj2nszVW5XQJbhQWqk":69},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":66,"created_at":67,"updated_at":68,"published_at":23},"inc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak","INC Ransom Extorted 24 US Law Firms; 58% Paid Without a Leak","SOCRadar found 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign; only 10 of 24 appear on INC's leak site, implying 14 firms paid or stayed unlisted.","SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, cross-referenced them against INC's leak site, and found only 10 of 24 (42%) listed, implying 14 (58%) paid or are unlisted.",[10,11,12,13,14],"INC Ransom","law firm","extortion","leak site","US","# INC Ransom Extorted 24 US Law Firms; 58% Paid Without a Leak\n\n*SOCRadar found 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign; only 10 of 24 appear on INC's leak site, implying 14 firms paid or stayed unlisted.*\n\n**Tags:** `INC Ransom` `law firm` `extortion` `leak site` `US`\n\n> SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, cross-referenced them against INC's leak site, and found only 10 of 24 (42%) listed, implying 14 (58%) paid or are unlisted.\n\n---\n\n## 24 Law Firms, 10 Listed, 14 Paid\n\nSOCRadar identified 24 individualized INC Ransom extortion pages for US law firms in a March 2026 campaign, each hosted on one of two IP addresses with its own countdown timer and victim-specific branding. Cross-referencing the 24 firms against INC’s leak site shows 10 (41.67%) listed and 14 (58.33%) not listed — a higher non-listing rate than typical ransomware clusters, consistent with most victims resolving the incident via payment or a negotiated partial arrangement rather than a public leak.\n\n## The Extortion Pages\n\nEach of the 24 pages is a dedicated HTML template built for a specific US law firm, with its own branding, contact details, and countdown timer. SOCRadar assesses with high confidence that the pages are tied to INC Ransom based on content and infrastructure overlap.\n\nThe pages went offline around the time the campaign became public and are no longer reachable. That timing is typical for INC, which pulls the sites once the campaign is public to prevent victims from screenshotting or archiving them before they pay.\n\n## The Payment Signal\n\nCross-referencing the 24 firms against INC’s leak site yields a clean split: 10 (41.67%) are listed, 14 (58.33%) are not. That non-listing rate sits above what we typically see across ransomware clusters, where the majority of victims end up on the DLS after a missed deadline. Here, more than half resolved the incident in a way that kept them off the site — payment, a negotiated partial arrangement, or an outcome we can’t see from the outside.\n\nIt’s still an absence, not a confirmation. But it’s a more direct payment-adjacent signal than most ransomware reporting gets to work with, because this cluster hands us a matched set of victims to check one by one.\n\n## Why It Matters\n\nThe 58% non-listing rate is the tell. Across typical ransomware clusters, the majority of victims end up on the DLS after a missed deadline, which means the not-listed share usually sits in the low-to-mid 40s. Here, 14 of  24 firms stayed off the site — a rate that points to a deliberate resolution path rather than a missed window. That’s a stronger payment-adjacent signal than most ransomware reporting gets to work with, because this cluster hands us a matched set of victims to check one by one.\n\nThe tactic is aimed at the victim’s client base. INC didn’t just encrypt the law firm and wait for the IT team to pay; it emailed the firm’s own clients with a dedicated HTML page, complete with countdown timer and victim-specific branding. That’s the people a law firm depends on most to trust them with privileged matters, and it’s what makes the pressure work. The page is built for the client, not the firm’s internal staff.\n\nThat’s a strong incentive for other affiliates to copy the pattern against any client-facing profession. Accounting, healthcare, and financial advisory all have the same client-facing surface and the same reputational risk. If the law firm’s clients get a dedicated page with a countdown, the accounting firm’s clients will want one too. Expect to see this tactic spread across the next few months as affiliates start working the same client-facing verticals.\n\n## Key points\n\n- SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, hosted across two IP addresses.\n- Cross-referencing the 24 firms against INC's leak site shows 10 of 24 (41.67%) listed and 14 of 24 (58.33%) not listed.\n- The 58% not-listed rate implies those firms paid, negotiated a partial deal, or resolved the incident without a public leak.\n- Each page is a dedicated HTML page with a countdown timer, built for a specific US law firm and likely shared with the firm's clients to pressure payment.\n- All 24 pages went offline around the time the campaign went public and are no longer reachable.\n\n## Further reading & sources\n\n- [INC Ransom's Law Firm Extortion: %58 Paid?](https:\u002F\u002Fsocradar.io\u002Fblog\u002Finc-ransom-law-firm-extortion) — SOC Radar\n- [Ongoing Targeted Campaign Against US Law Firms | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Ftargeted-campaign-us-law-firms)\n- [Dark Web Profile: Silent Ransom Group (LeakedData)](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fdark-web-profile-silent-ransom-group-leakeddata)\n- [Resecurity | Silent Ransom Group (SRG): Uncovering DNS Fast Flux Infrastructure](https:\u002F\u002Fwww.resecurity.com\u002Fblog\u002Farticle\u002Fsilent-ransom-group-srg-uncovering-dns-fast-flux-infrastructure)\n- [BianLian ransomware gang shifts focus to pure data extortion](https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbianlian-ransomware-gang-shifts-focus-to-pure-data-extortion)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs](https:\u002F\u002Fdatabreaches.net\u002F2026\u002F08\u002F21\u002Ftroutman-pepper-locke-silent-as-threat-actors-leak-client-data-tens-of-thousands-of-ssns)\n- [Sicarii Ransomware Encryption Key Handling Defect](https:\u002F\u002Fhalcyon.ai\u002Fransomware-alerts\u002Falert-sicarii-ransomware-encryption-key-handling-defect)\n- [FBI disrupts the Dispossessor ransomware operation, seizes servers](https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-disrupts-the-dispossessor-ransomware-operation-seizes-servers)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak.png?v=7e1c94e2e7",{"actors":18,"malware":41,"targets":45,"timeline":50,"industries":62},[19,24,31,34,37],{"url":20,"name":21,"slug":21,"type":22,"origin":23,"motivation":23},"\u002Fthreat-groups\u002Fbianlian","bianlian","ransomware",null,{"url":25,"name":26,"slug":27,"type":28,"origin":29,"motivation":30},"\u002Fthreat-groups\u002Fsilent-ransom-group","Silent Ransom Group","silent-ransom-group","cybercrime","Russia (likely, per CrowdStrike)","financial",{"url":32,"name":33,"slug":33,"type":22,"origin":23,"motivation":23},"\u002Fthreat-groups\u002Fdispossessor","dispossessor",{"url":35,"name":10,"slug":36,"type":22,"origin":23,"motivation":30},"\u002Fthreat-groups\u002Finc-ransom","inc-ransom",{"url":38,"name":39,"slug":40,"type":22,"origin":23,"motivation":30},"\u002Fthreat-groups\u002Fsicarii","Sicarii","sicarii",[42,44],{"name":43},"Dispossessor Ransomware",{"name":39},[46],{"name":47,"sector":48,"status":49,"geography":23},"Troutman Pepper Locke","legal","claimed",[51,55,59],{"date":52,"event":53,"description":54},"2026-03","Campaign","INC Ransom encryption streak against US law firms",{"date":56,"event":57,"description":58},"2026-04","Leak","SRG leak site listed 38 law firms",{"date":60,"event":57,"description":61},"2026-06-29","48 law firms leaked by June 29",[63],{"url":64,"name":65,"slug":48},"\u002Findustries\u002Flegal","Legal","ransomware_incident","2026-08-31T12:15:18.010257+00:00","2026-10-16T12:28:58.582784+00:00",{"articles":70},[71,80,90,101],{"slug":72,"title":73,"summary":74,"tags":75,"hero_image_url":78,"story_type":66,"created_at":79},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[26,47,11,76,77,22],"data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":81,"title":82,"summary":83,"tags":84,"hero_image_url":88,"story_type":66,"created_at":89},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[22,85,86,87,12],"data-exfiltration","coinbasecartel","dark-web","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":99,"story_type":66,"created_at":100},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[95,96,97,98,14],"Qilin","Ransomware","AhnLab ASEC","Manufacturing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d","2026-09-18T07:07:39.952851+00:00",{"slug":102,"title":103,"summary":104,"tags":105,"hero_image_url":110,"story_type":111,"created_at":112},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.",[106,107,12,108,109],"UNC6671","vishing","BlackFile","DLS","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b","campaign","2026-09-22T07:04:26.729885+00:00"]