[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9o1Qwo0p6lp5_W8kAX6njheulB4Oph1ftRLH9VRD4NY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":46},"c94d1bd4-0b97-4e48-ac6e-3d2d2834a707","silent-ransom-group-uses-social-engineering-and-physical-access-for-data-theft","f9011709-9cd2-487a-bfd4-cf67d35170c8","Silent Ransom Group Uses Social Engineering and Physical Access for Data Theft","The Silent Ransom Group demonstrates how attackers combine social engineering with physical access to bypass traditional security controls. By impersonating IT support staff, they exploit human trust to gain remote access through phishing calls or physical entry to insert malicious devices. This hybrid approach highlights that even organizations with robust technical defenses remain vulnerable when employees lack proper verification procedures for IT personnel. The subsequent data extortion shows how initial access can quickly escalate to significant business impact without proper detection and response capabilities.","**Immediate actions:**\n- Implement strict identity verification procedures for all IT support requests, requiring multiple forms of authentication\n- Establish a mandatory call-back policy to verify IT personnel through official company directories before granting any access\n- Disable USB ports and external device connectivity on all workstations unless specifically authorized\n\n**Long-term improvements:**\n- Deploy comprehensive security awareness training focusing on social engineering tactics and impersonation attacks\n- Implement visitor management systems with escort requirements and background verification for all on-site technical support\n- Establish data classification and access controls to limit exposure of sensitive information\n\n**Detection measures:**\n- Monitor and log all external device connections and unusual data access patterns\n- Implement endpoint detection and response (EDR) solutions to identify suspicious file transfers or system modifications",[12,13,14,15,16,17],"CIS Control 14 (Controlled Access Based on Need to Know)","CIS Control 8 (Audit Log Management)","NIST AC-3 (Access Enforcement)","NIST AT-2 (Security Awareness Training)","NIST PE-2 (Physical Access Authorizations)","NIST MP-7 (Media Use)",{},"published","2026-05-27T13:20:17.382242+00:00","2026-05-27T13:20:17.122+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-warns-of-silent-ransom-group-in-person-data-theft-attacks\u002F","fbi-warns-of-in-person-data-theft-attacks-from-extortion-gang-636e8a","FBI warns of in-person data theft attacks from extortion gang",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[40],{"id":41,"date":42,"edition":43,"title":44,"audio_url":45},"0bf775ef-3a7d-492d-8c15-3d6c80cc4010","2026-05-27","afternoon","ThreatNoir Afternoon Brief — May 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-05-27\u002Fthreatnoir-afternoon-brief-2026-05-27.mp3",[47,51,55],{"slug":48,"name":49,"problem":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":52,"name":53,"problem":54},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":56,"name":57,"problem":58},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]