FBI Warns Silent Ransom Group Is Using In-Person Data Theft Against Law Firms
Summary
The FBI warns that Silent Ransom Group actors are targeting U.S. law firms by impersonating IT support, seeking remote access, or visiting in person to connect storage devices and steal data for extortion.
Key points
- The FBI says SRG actors pose as IT staff in phone calls or phishing emails and urge employees to grant remote desktop access.
- If remote access fails, the group may send someone to the victim’s location to connect a USB drive or external hard drive.
- The FBI identifies unauthorized storage devices and people claiming to be IT support as possible indicators.
- The group uses stolen data for extortion, threatening to sell or publish it and contacting employees or clients to pressure victims.
- The article says SRG has been active since at least 2022 and has targeted U.S. legal and financial organizations since early 2023.
- The group is also known as Luna Moth, Chatty Spider, and UNC3753; it has been linked to BazarCall campaigns.
Article Details
- Event Type
- FBI warning about social-engineering and in-person data-theft attacks targeting U.S. law firms
- Impact
- The attackers seek remote or physical access to victim computers to steal data, then threaten to sell or publish it and pressure victims into ransom negotiations.
MITRE ATT&CK
T1052.001 · Exfiltration over USBThe FBI says actors may connect USB drives or external hard drives to victim computers to steal data.T1219 · Remote Access ToolsThe FBI says the actors seek access to victim computers through remote desktop sessions and legitimate remote access tools.T1566 · PhishingThe FBI says the group uses phishing emails to prompt employees to contact actors posing as IT support.
Threat Actors
Silent Ransom GroupThe FBI says this extortion group targets U.S. law firms through social engineering and in-person access to steal data. The article identifies Luna Moth, Chatty Spider, and UNC3753 as names for the same group.UNC3753The article identifies UNC3753 as another name for the Silent Ransom Group, which the FBI says targets U.S. law firms to steal data for extortion.
Malware
ContiAs previously reported by BleepingComputer, the same group of threat actors was also linked to BazarCall campaigns that provided initial access to corporate networks in Conti and Ryuk ransomware attacks.RyukAs previously reported by BleepingComputer, the same group of threat actors was also linked to BazarCall campaigns that provided initial access to corporate networks in Conti and Ryuk ransomware attacks.