Fake “IT support” calls are being used against US law firms. Give your staff a rule, and practice it every month.
In May 2026 the FBI warned that a group it calls Silent Ransom Group (also known as Luna Moth) has targeted US law firms by phone and email, posing as IT support to get staff onto a remote-access session. The FBI says traditional antivirus is unlikely to flag it, because the attackers use legitimate remote-access tools. The FBI’s recommendations include policies on when and how IT support will contact and authenticate itself to employees, and staff training on identifying, resisting and reporting phishing. This program turns that into a written rule and a monthly practice run.
Book a 30-minute call Reply by email Start for $249/month
What is documented
- FBI Flash FLASH-20260526-01 (May 26, 2026): Silent Ransom Group has “consistently targeted US-based law firms since Spring 2023.” As of spring 2026 its actors call, or send emails that urge employees to call, posing as the firm’s own IT department, then direct the employee to grant a remote desktop session. If that fails, the FBI says they may send someone in person to plug a storage device into a computer. They steal data and threaten to publish it. ic3.gov/CSA/2026/260526.pdf
- Holland & Knight (reported by Cybernews, Oct 10, 2026): the firm said an attacker used social engineering to gain unauthorized remote access to a firm computer; files with Social Security numbers were involved and 14 clients were notified. The same article reports a separate Squire Patton Boggs data-breach disclosure involving Social Security numbers (the article does not say how that one happened). cybernews.com
- Sheppard Mullin and Fragomen (CalCyber, Oct 14, 2026, citing California Attorney General notices): in both cases the firm’s notice describes a single person or account being socially engineered, and files were exposed. calcyber.com
These are large firms. We have no figures on how often small firms are hit and we do not claim any. The method (a convincing call to one employee) does not depend on firm size.
What you get each month
- A one-page callback rule for your firm. Plain words your staff can follow: any request from “IT,” a vendor, a client or a partner to install or run remote-access software, reset a password, read out a code, plug in a drive or change payment details gets a hang-up and a call back on a number you already had on file. We write it with you the first month and revise it as the drills show what is unclear.
- One simulated drill. With your written authorization, we send your staff an email with a harmless fake “IT support” or invoice-callback lure that follows the pattern the FBI describes. We never collect passwords or take control of a computer; we only record who followed the rule and who did not, and give you a short debrief to share with staff.
- A proof pack (PDF). The rule, the date it was issued, the drill dates and aggregate results, and what changed afterward, in a form you can attach to a cyber-insurance renewal questionnaire or give to your broker. We do not promise any insurer will accept it or lower your premium.
What this is not
- Not a replacement for multi-factor authentication, endpoint protection or your IT provider. It covers the person on the phone.
- Not legal advice or insurance advice. Check your own policy’s social-engineering coverage with your broker.
- Not a certification. 013 Labs is a small US company; we do not claim a security accreditation.
What it costs
Founding price for the first 5 firms. One flat monthly price, billed by card through Stripe. It covers the callback-rule review, the monthly drill (only after your written authorization) and the monthly proof pack described above.
After you subscribe, Darren emails you within one business day to set up the written drill authorization. No drill runs until your firm approves it in writing.
Cancel and refund
- Cancel any time before your next billing date by emailing [email protected]; you will not be charged again.
- If you are not satisfied within 14 days of your first payment, email us and the first month is refunded in full.
Not sure yet? The first call is free.
Book a call or reply by email
Book 30 minutes with Darren [email protected]
On the call we walk through how your firm currently verifies unexpected requests and where a caller could get through. No access to your systems is needed.