FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data
Source SecurityWeek
Description
The FBI has issued an alert about the Silent Ransom Group (SRG) targeting law firms primarily in the US by impersonating IT support to gain access to systems. The attackers use social engineering, including phishing and phone calls, to convince employees to grant remote access or, if unsuccessful, send operatives in person to insert USB drives or external devices into victim computers. After gaining access, SRG escalates privileges and exfiltrates data using legitimate tools like WinSCP or Rclone, often avoiding ransomware deployment. The group then extorts victims by threatening to publish or sell stolen data. Traditional antivirus solutions are unlikely to detect these intrusions due to the use of legitimate system tools. The FBI recommends verifying credentials, limiting access, employee training, and disabling remote access and external drive permissions to prevent such attacks.