[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBdeuYo6u0qB-57DSVbCLqhyOpv6hRT-nXtr4AmHshhA":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"ce2bd1a1-3703-4612-aa49-03646027d314","FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data","fbi-hackers-sending-operatives-in-person-to-insert-usb-drives-and-steal-data-70e3a9","The FBI has issued an alert warning of Silent Ransom Group attacks targeting law firms. The post FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data appeared first on SecurityWeek.","The FBI has issued an alert about Silent Ransom Group (SRG) targeting US law firms with an evolved attack strategy combining social engineering, remote access exploitation, and in-person USB device insertion. The threat actor impersonates IT support through phishing and callback schemes; if remote access fails, they physically insert USB\u002Fexternal drives to exfiltrate data using legitimate tools like WinSCP and Rclone. SRG avoids deploying ransomware, instead extorting victims by threatening to sell or publish stolen data after contacting employees and clients.","FBI warns Silent Ransom Group sends operatives to insert USB drives for data theft at law firms.","https:\u002F\u002Fwww.securityweek.com\u002Ffbi-hackers-sending-operatives-in-person-to-insert-usb-drives-and-steal-data\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F04\u002FFBI-Surveillance.jpg","2026-05-27T08:33:34+00:00","2026-05-27T10:00:05.146993+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"Silent Ransom Group (SRG)","threat_actor",{"name":21,"type":22},"WinSCP","product",{"name":24,"type":22},"Rclone",{"name":26,"type":27},"Remote Desktop Protocol (RDP)","technology",{"name":29,"type":30},"Google","vendor",{"name":32,"type":30},"Microsoft","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[55,57],{"type":53,"value":21,"context":56},"Legitimate tool abused by SRG for data exfiltration",{"type":53,"value":24,"context":56},[29,32,21],{"controls":60,"vendors":140},[61,89,115],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,73,81],{"vendor_slug":67,"vendor_name":32,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,99,107],{"vendor_slug":67,"vendor_name":32,"vendor_logo":68,"product_slug":95,"product_name":96,"url":97,"description":98},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":116,"name":117,"problem":118,"products":119},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[120,126,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":116,"product_name":137,"url":138,"description":139},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":152},"multi-vector-attacks-combine-social-engineering-with-physical-infiltration","Multi-Vector Attacks Combine Social Engineering with Physical Infiltration","The Silent Ransom Group demonstrates how threat actors are evolving beyond traditional remote attacks by combining social engineering, remote exploitation, and physical infiltration tactics. When initial phishing and callback schemes fail to provide adequate remote access, attackers escalate to physically inserting USB devices on-site to exfiltrate data using legitimate tools. This hybrid approach exploits both human psychology and physical security gaps, making detection more difficult since no ransomware is deployed. Organizations must recognize that modern threats require defense strategies addressing both digital and physical attack vectors.",[146,147,148,149,150,151],"CIS Control 16 (Account Monitoring)","CIS Control 11 (Data Recovery)","NIST AC-2 (Account Management)","NIST PE-2 (Physical Access Authorizations)","NIST AT-2 (Security Awareness Training)","ISO 27001 A.7.1.2 (Physical Entry Controls)",{}]