Silent Ransom Group (SRG) has evolved its tactics to target law firms by impersonating IT support personnel. They initiate attacks through phishing and social engineering to gain remote desktop access. If remote access attempts fail, SRG sends operatives physically to victim locations to insert USB or external drives under the guise of IT maintenance. Once inside, they escalate privileges and exfiltrate sensitive data using legitimate file transfer tools such as WinSCP and Rclone, sometimes copying data to cloud platforms like Google Drive or OneDrive. The group avoids ransomware deployment, focusing instead on data theft and extortion. These attacks leave minimal forensic artifacts and evade traditional antivirus detection. The FBI alert emphasizes the need for strict verification of IT support personnel, access controls, and employee awareness to mitigate these threats.

SRG's attacks result in unauthorized access to sensitive data of law firms, leading to data exfiltration without ransomware encryption. The stolen data is used for extortion, threatening to publish or sell confidential information, which can cause reputational damage, financial loss, and legal consequences for victims. The use of legitimate tools and in-person device insertion complicates detection and response efforts. The attacks specifically target law firms, impacting confidentiality and client trust.

The FBI recommends verifying the credentials of all individuals requesting access to company assets, especially those claiming to be IT support. Organizations should limit access to sensitive data and implement strict policies for IT support communication and authentication. Employee training to recognize phishing and social engineering attempts is critical. Additional measures include backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation. These steps help prevent unauthorized access and data exfiltration by SRG. There is no mention of a patch or official fix, so these mitigations focus on procedural and technical controls.