This extortion gang skips the hacking entirely and just shows up at your office
Source Reddit BlueTeam
Discussion
A criminal extortion group known as the Silent Ransom Group bypasses traditional hacking techniques by using social engineering and physical intrusion. They initiate contact with a benign-looking invoice email, followed by phone calls impersonating IT staff to gain remote access via legitimate tools. They steal sensitive data from cloud services and corporate email, targeting especially law firms. When remote tactics fail, they escalate by physically visiting offices posing as IT technicians, using USB sticks to compromise systems. The attack relies on confidence tricks rather than malware or exploits.
r/Information_Security (opens in a new tab)u/Syncplify0 points0 comments
Silent Ransom Group doesn't deploy ransomware, doesn't use zero-days, and doesn't need to phish your credentials. Their whole operation runs on confidence tricks and a plausible story.
It opens with the most boring email imaginable, just an invoice with no links and no attachments, doing nothing except leaving someone wondering if something is wrong. Then a phone call follows from someone claiming to be your IT helpdesk, using real names pulled from your company website or LinkedIn, who talks the victim into a screen-sharing session and installs a legitimate remote-access tool. From there they quietly drain whatever they can find across SharePoint, OneDrive, and corporate email. One investigated case ended with 16GB stolen.
They target law firms especially, given that client files, merger plans, and regulatory filings are basically a goldmine for extortionists.
And then it gets weird. When the phone approach fails, the FBI has warned they've started sending someone to physically show up at the office posing as an IT technician, plug in a USB stick, and walk out.
The whole attack runs on nothing but a convincing story and a USB stick, and before the fake technician has even made it back to their car, the extortion email is already in your inbox. At what point does security training cover "what to do when someone walks into your office with a USB stick"?