The Silent Ransom Group conducts extortion campaigns without deploying ransomware, zero-day exploits, or phishing. Their method starts with a simple invoice email, then a phone call impersonating IT personnel to convince victims to share screens and install legitimate remote access software. They exfiltrate data from SharePoint, OneDrive, and email, with reported thefts of large data volumes. If remote social engineering fails, they physically enter offices posing as IT technicians, use USB sticks to compromise systems, and immediately send extortion demands. This approach leverages social engineering and physical presence rather than technical exploits.

The group can steal significant amounts of sensitive corporate data, including client files and regulatory documents, which can be used for extortion. The physical intrusion vector increases risk by bypassing many technical controls. The threat is particularly impactful for law firms due to the sensitive nature of their data. The attack can result in data loss, reputational damage, and financial extortion demands without the need for malware or network exploitation.

No official patch or fix applies as this is a social engineering and physical security threat. Organizations should enhance security training to include procedures for handling unexpected visitors with USB devices and verify identities of anyone claiming to be IT personnel. Physical access controls and visitor verification protocols should be strengthened. Awareness campaigns should emphasize skepticism of unsolicited invoices and phone calls requesting remote access. Monitor and restrict use of remote access tools and USB devices where possible.