SRG's hybrid threat: from misleading call to physical intrusion with USB to exfiltered law and signature data

The recent FBI warning about the Silent Ransom Group (SRG) extortion group marks a significant escalation: it is no longer just malicious emails or remote accesses, but a hybrid tactic in which attackers present themselves as support personnel and, if they fail in remote deception, physically go to the offices to introduce storage devices in the victims' teams and extract sensitive data.

This combination of vishing (social engineering phone call), phishing of return and physical access alters the risk calculation for law firms and financial firms: the confidentiality of files, legal privileges - client and regulatory obligations are jeopardized by an intrusion that begins with an apparently harmless call but can end with the removal of gigabytes of committed documents.

SRG - also identified in the industry as Luna Moth / Chatty Spider / UNC3753 - has a background linked to campaigns that served as a gateway for Ransomware families. The tactic described by the FBI includes the supplanting of technical support, the request to start remote sessions with legitimate tools and, in case of refusal, the sending of an actor in person to connect USB or external disks. The operating mode is already documented within the MITRE ATT & CK framework for exfiltration technique by external devices: https: / / attack.mitre.org / techniques / T1052 / 001 /.

The legal and reputational consequences for the firms attacked can be severe: filtration of commercial secrets, ongoing litigation, penalties for failure to comply with data protection obligations and loss of customer confidence. In addition, the tactic of calling directly on customers or employees to pressure the payment of the ransom increases the violence of blackmail and complicates the communication of incidents with the affected parties.

To mitigate this risk it is essential to combine technical controls, processes and human training. At the organizational level it is appropriate to implement policies that require prior verification of any support request: documented internal tickets, known channel confirmation and express prohibition of allowing remote access or connecting external devices without the authorization of a security officer. On the technical level, USB port locking and control, local privilege restriction, EDR use with device locking capabilities and network segmentation reduce the attack surface.

Physical surveillance also matters: registering visitors, requiring the support of authorized personnel within sensitive facilities, and keeping access cameras or records can create forensic evidence and deter attempts at rapprochement. Signatures should review their backup and recovery protocols, confirming that backups are offline or inaccessible from regular workstations to avoid destruction or encryption by the attacker after exfiltration.

In case of suspicion or confirmation of intrusion, it is key do not negotiate or pay in haste without specialized advice: activate the incident response plan, preserve evidence (logs, forensic images), notify competent authorities and communicate clearly to customers when required by law. The FBI recommends reporting such incidents and shares indicators that help identify the presence of SRG; the original notice can be found here: https: / / www.ic3.gov / CSA / 2026 / 260526.pdf.

For security professionals and legal officials, it is also recommended to review practical guides and national resources on ransomware and extortion to align policies and tabletop exercises with realistic scenarios. A useful starting point is the CISA page with recommendations on ransomware and good resilience practices: https: / / www.cisa.gov / ransomware.

The central lesson is that attackers are combining social, technical and physical skills to overcome traditional controls; that's why the defence must be equally multidimensional, integrating technology, processes, training and physical controls. For legal firms, protecting confidentiality is not only a technical issue: it is a professional obligation that requires the review of contracts, insurance and incident response plans with the same seriousness with which the most sensitive files are managed.