FBI Warns Silent Ransom Group Uses In-Person USB Intrusions
Summary
The FBI says Silent Ransom Group is posing as IT support to target law firms, using remote access or in-person USB drives to steal data and extort victims without deploying file-encrypting ransomware.
Key points
- The FBI says Silent Ransom Group has targeted US law firms since at least 2023, often using callback phishing and social engineering.
- In recent campaigns, attackers pose as the victim’s IT staff and direct employees to grant access through remote desktop sessions.
- If remote access attempts fail, an operative may visit in person, claim they need to image or back up a device, and insert a USB drive.
- After gaining access, attackers escalate privileges and exfiltrate data without deploying file-encrypting ransomware.
- The group reportedly uses WinSCP, Rclone, internal file-sharing platforms, or external drives to move data, then threatens to sell or publish it.
- The FBI recommends verifying IT support identities, limiting sensitive-data access, training staff, using phishing-resistant MFA, and restricting remote access and external-drive permissions.
Article Details
- Event Type
- FBI warning about an updated Silent Ransom Group extortion campaign impersonating victim organizations’ IT support.
- Impact
- The attackers seek access through remote desktop sessions or an in-person visit to insert an external drive or USB device, then escalate privileges and exfiltrate data. They threaten to sell or publish stolen data and contact victims’ employees and clients to increase pressure. The FBI says the observed attacks did not deploy file-encrypting ransomware.
MITRE ATT&CK
T1052.001 · Exfiltration over USBThe attackers exfiltrate data to an external hard drive or USB drive inserted into the victim’s computer.T1219 · Remote Access ToolsThe attackers use remote access software to gain access to victims’ machines.T1566.002 · Spearphishing LinkThe group sends phishing emails containing links to remote access software.T1566.004 · Spearphishing VoiceThe group directly calls employees or urges them to call an attacker posing as IT support.T1567.002 · Exfiltration to Cloud StorageIn some instances, data is copied to file-sharing platforms including Google Drive and Microsoft OneDrive.