The infamous extortion gang Silent Ransom Group (SRG) has been impersonating IT support in a fresh campaign targeting law firms, the FBI warns.
Active since at least 2022, SRG has been targeting law firms in the US since at least 2023, mainly through callback phishing emails and social engineering calls, claiming to aid victims in canceling subscription fees.
In a May 2025 alert, the FBI warned of SRG’s phishing emails containing links to remote access software that allowed the attackers to quickly exfiltrate data from the victims’ systems.
In attacks observed this year, the threat actor has updated its tactics, now posing as an employee from the victim’s IT department.
“SRG actors either directly call or send phishing emails to urge employees to call the SRG actor posing as IT support,” the Bureau says in a new alert (PDF).
During the call, the attackers direct the victim organizations’ employees to grant access to their machines through remote desktop sessions.
If the attempt fails, however, they send an individual posing as IT support in person to insert a device into the computer.
“In this scheme, the threat actor tells the victim they need to image the device or create a backup file to address potential impacts from the phishing email,” the FBI explains.
After gaining access to the machine, the attackers escalate their privileges and immediately proceed to exfiltrating data, without deploying file-encrypting ransomware.
For data exfiltration, SRG uses WinSCP (Windows Secure Copy), or a version of Rclone. In some instances, they copy the data to internal file-sharing platforms, including Google Drive and Microsoft OneDrive.
“By sending someone in-person to the victim’s location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim’s computer,” the FBI notes.
The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.
“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.
To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.
Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.
Related: 185,000 Likely Impacted by 7-Eleven Data Breach
Related: Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries
Related: West Pharmaceutical Services Hit by Disruptive Ransomware Attack
Related: Ransomware Group Takes Credit for Trellix Hack
