FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data
FBI warns Silent Ransom Group sends operatives to insert USB drives for data theft at law firms.
The FBI has issued an alert about Silent Ransom Group (SRG) targeting US law firms with an evolved attack strategy combining social engineering, remote access exploitation, and in-person USB device insertion. The threat actor impersonates IT support through phishing and callback schemes; if remote access fails, they physically insert USB/external drives to exfiltrate data using legitimate tools like WinSCP and Rclone. SRG avoids deploying ransomware, instead extorting victims by threatening to sell or publish stolen data after contacting employees and clients.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Silent Ransom Group demonstrates how threat actors are evolving beyond traditional remote attacks by combining social engineering, remote exploitation, and physical infiltration tactics. When initial phishing and callback schemes fail to provide adequate remote access, attackers escalate to physically inserting USB devices on-site to exfiltrate data using legitimate tools. This hybrid approach exploits both human psychology and physical security gaps, making detection more difficult since no ransomware is deployed. Organizations must recognize that modern threats require defense strategies addressing both digital and physical attack vectors.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — WinSCP
- malware — Rclone