Extortion Gang Sends In-Person Attackers to Exfiltrate Data

Researchers report an ongoing targeted extortion campaign (UNC3753 / “Silent Ransom Group”) against US law firms that uses vishing, social-engineering pretexts, RMM tools, and physical impersonation of IT staff to obtain remote access or onsite access to endpoints, exfiltrate proprietary legal agreements, PII, and financial records, and demand extortion. Recommended mitigations include employee awareness training and strict visitor/technician verification and escort policies.