[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVmon-pZHvlr8QNPNGatBaGV3MhDZkg-pjLKKhhx5ag4":3},{"article":4,"iocs":52,"watch_terms":61,"solutions":62,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f9011709-9cd2-487a-bfd4-cf67d35170c8","FBI warns of in-person data theft attacks from extortion gang","fbi-warns-of-in-person-data-theft-attacks-from-extortion-gang-636e8a","The FBI warned on Tuesday that the Silent Ransom Group (SRG) extortion gang is now targeting U.S.-based law firms in in-person data theft attacks. [...]","The FBI issued a flash alert warning that the Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, is conducting in-person data theft attacks against U.S. law firms. The threat actors use social engineering to pose as IT support staff, either remotely accessing systems via phishing and phone calls or physically visiting victim locations to insert USB drives and external hard drives. SRG then extorts victims by threatening to sell or publish stolen data unless ransom is paid.","FBI warns Silent Ransom Group targets US law firms with in-person data theft and phishing attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-warns-of-silent-ransom-group-in-person-data-theft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F27\u002FFBI.jpg","2026-05-27T11:51:12+00:00","2026-05-27T12:00:08.651678+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Silent Ransom Group (SRG)","threat_actor",{"name":21,"type":19},"Luna Moth",{"name":23,"type":19},"Chatty Spider",{"name":25,"type":26},"BazarCall","campaign",{"name":28,"type":19},"Conti",{"name":30,"type":19},"Ryuk","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[53,55,57,58],{"type":51,"value":18,"context":54},"Extortion gang targeting U.S. law firms via phishing and in-person data theft",{"type":51,"value":21,"context":56},"Alternate name for Silent Ransom Group",{"type":51,"value":23,"context":56},{"type":51,"value":59,"context":60},"UNC3753","Threat intelligence identifier for Silent Ransom Group",[],{"controls":63,"vendors":147},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":94,"name":95,"problem":96,"products":97},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"slug":123,"name":124,"problem":125,"products":126},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[127,134,141],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":131,"url":132,"description":133},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":123,"product_name":138,"url":139,"description":140},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":142,"product_name":143,"url":145,"description":146},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":159},"silent-ransom-group-uses-social-engineering-and-physical-access-for-data-theft","Silent Ransom Group Uses Social Engineering and Physical Access for Data Theft","The Silent Ransom Group demonstrates how attackers combine social engineering with physical access to bypass traditional security controls. By impersonating IT support staff, they exploit human trust to gain remote access through phishing calls or physical entry to insert malicious devices. This hybrid approach highlights that even organizations with robust technical defenses remain vulnerable when employees lack proper verification procedures for IT personnel. The subsequent data extortion shows how initial access can quickly escalate to significant business impact without proper detection and response capabilities.",[153,154,155,156,157,158],"CIS Control 14 (Controlled Access Based on Need to Know)","CIS Control 8 (Audit Log Management)","NIST AC-3 (Access Enforcement)","NIST AT-2 (Security Awareness Training)","NIST PE-2 (Physical Access Authorizations)","NIST MP-7 (Media Use)",{}]