Silent Ransom Group Impersonates IT to Steal Data

A sophisticated ransomware group is now combining digital intrusions with physical infiltration, sending imposters posing as IT support personnel directly into corporate offices to steal sensitive data, according to a joint advisory from Google and the Federal Bureau of Investigation. The group, identified by researchers as the Silent Ransom Group, has targeted dozens of victims, primarily U.S.-based law firms, in a campaign documented between January and May of this year.

The operation begins with traditional social engineering, where attackers send phishing emails and make follow-up phone calls while impersonating a company’s own IT staff. These calls are used to build trust and guide employees to download screensharing applications or misuse features in tools like Zoom or Microsoft Teams, thereby bypassing initial security controls. This digital reconnaissance phase gathers internal details about IT procedures and personnel, which are then used to craft convincing fake identities.

Armed with this intelligence, members of the group then arrive at victim offices dressed in business attire, often with falsified identification badges. They present themselves as IT support...