Hackers are turning up to victim's work dressed as IT support to install malware in-person, FBI warns

Date:
Thu, 28 May 2026 12:05:00 +0000

Description:
If a remote session fails, hackers will come to install malware in person.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter FBI warned about Silent Ransom Group (SRG), a threat actor impersonating IT staff to steal files and plant malware directly at victim offices SRG, also known as Luna Moth/Chatty Spider/UNC3753, primarily targets US law firms, starting with vishing calls and escalating to inperson intrusions with external drives Active since 2022 and linked to BazarCall, Conti, and Ryuk campaigns, SRG extorts victims via ransom emails, pressure calls, and a leak site naming and shaming nonpayers The Federal Bureau of Investigation (FBI) is warning about hackers showing up at peoples offices, pretending to be IT support. They sit at peoples desks, pull all sensitive files into an external drive and leave malware behind, all while pretending to be fixing a technical problem.

In a newly released flash alert, the FBI says this cheeky attack is being
done by a threat actor calling itself the Silent Ransom Group (SRG). This threat actor, active for roughly four years now, starts their attack with a phone call. They mostly target US-based law firms and first try to get the victim to install a remote desktop management solution and grant them access. If that attempt fails, they will come, in person, carrying flash drives, external disks, and other equipment needed to execute the attack. Once they steal the files, theyll quietly escalate privileges and step away, engaging
in extortion at a later date: Latest Videos From You may like Watch out Microsoft Teams users - hackers are spreading a dangerous new phishing scam, here's what we know 'What begins as a phone call from 'IT support' ends with
a fully instrumented network compromise': This fake tech support scam tricks employees into infecting their own company devices FBI slams cybercriminals for attacking schools, hospitals, as crypto fraud soars Chatty Spider By sending someone in-person to the victims location to facilitate the
intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victims computer, the FBI explained.
SRG actors use the exfiltrated victim data to extort the victim by sending a ransom email threatening to sell or post the data online. SRG actors also
call employees or clients of a victim company to pressure the victim to begin ransom negotiations.

Finally, the crooks have their own data leak website where they name-and-shame, in order to pressure the victims into paying the ransom demand.

SRG is also known as Luna Moth, Chatty Spider, and UNC3753, the FBI further explained. The group was first seen back in 2022, and while it struck organizations in different industries, it is primarily focused on law firms
in the US. According to BleepingComputer , this group was previously linked
to BazarCall campaigns, as well as Conti and Ryuk ransomware incidents.

Via BleepingComputer Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/hackers-are-turning-up-to-victims-work- dressed-as-it-support-to-install-malware-in-person-fbi-warns


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)