A cybercriminal gang has begun sending imposters posing as IT support workers directly into law firms’ offices to steal data, according to warnings issued by Google and the FBI in June 2026.
The group, known as Silent Ransom Group, targeted “dozens” of victims between January and May 2026. In some cases, fake IT personnel physically entered victims’ offices, where they connected to employees’ computers and used USB drives or remote access tools to steal sensitive data — including contracts, Social Security numbers, and financial and tax records.
The FBI confirmed the tactic directly: “We can confirm we have seen multiple instances of individuals impersonating IT support who have gained or attempted to gain physical in-person access to victim companies’ offices and/or devices as part of Silent Ransom Group’s scheme to exfiltrate data,” an FBI spokesperson told TechCrunch.
Google’s cybersecurity teams, Mandiant and Google Threat Intelligence Group, published a report on the campaign. Mandiant chief technology officer Charles Carmakal noted the company has investigated cases over the years involving planted insiders, bribed employees, and physical building access to facilitate cyberattacks.
The gang also uses more conventional methods: phishing emails, follow-up phone calls, and social engineering. Posing as corporate IT support, attackers convince employees to join screen-sharing sessions — either through dedicated apps or features built into tools like Zoom or Microsoft Teams — to bypass security controls and gain remote access.
Rather than encrypting victims’ data as in traditional ransomware attacks, Silent Ransom Group runs a leak site and threatens to publish stolen data unless victims pay. In one message reviewed by Google, the hackers warned: “In case of ignorance or no agreement, We will notify your employees, partners and customers, after which We will publish your data.”
The combination of digital and physical intrusion tactics may signal a broader escalation in how some cybercriminal groups pursue data theft and extortion.
Source: TechCrunch