Update, 23 October 2026: This story has been corrected: Google links the in-person visits to this gang as "likely", not certain, and the headline now says the FBI and Google "warn".
A data-theft gang known as Silent Ransom Group sometimes sends people posing as IT support to victims' offices to copy files onto USB drives, according to an FBI alert and a Google report. The targets are mainly US law firms. Google's Mandiant and Threat Intelligence Group said on 5 June 2026 that the campaign hit "dozens" of organisations between January and May.
READ ALSO: OpenCode Breach Puts Developers' OpenAI, Anthropic and Google Keys at Risk
READ ALSO: Meta Removes 3.7 Million Accounts Tied to West African Scam Networks
What the FBI and Google each said
The FBI issued a Cyber FLASH alert on 26 May 2026 saying that if remote attempts fail, the group may send someone to a victim's office. The Register's coverage says the visitors claim they must image a device or make a backup after a phishing incident. An FBI spokesperson told TechCrunch the bureau had seen multiple instances of people impersonating IT support.
Google's report, "Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms", is more cautious. It says the physical intrusions are "likely associated" with the group it tracks as UNC3753, which is the same actor as Silent Ransom Group, based on timing, structure and targeting overlaps. Google says limited forensic evidence prevents formal attribution, and cites the FBI alert as corroboration. So the in-person tactic is reported by both, but the link to this specific gang is an assessment.
The gang now steals files rather than encrypting them, then threatens to publish them unless the victim pays.
How the attack works
Google describes the digital stage first. The gang sends an invoice-themed email with no malicious link, then calls the target posing as IT help desk staff and asks them to join a screen-sharing session in Zoom, Teams or Quick Assist. TechCrunch reports the stolen data includes contracts, Social Security numbers, and financial and tax records.
Google says that in some cases data theft began in under an hour, and extortion emails followed within about 30 minutes of the attackers leaving. The group runs a leak site. According to The Register's account of the FBI alert, it has operated since 2022 and has targeted the legal sector since 2023.
What to do
Google's report recommends these controls:
- Disable USB mass storage on corporate devices, or restrict it with group policy or device management.
- Log the ID of any visiting technician and verify them against a scheduled work order through a separate channel, not the number the visitor gives you.
- Escort all outside technicians.
- Block unapproved remote-support tools such as AnyDesk and consider limiting remote control in Zoom and Teams.
- Use phishing-resistant multi-factor authentication, especially on document stores.
- Alert on bulk file searches and downloads.
If someone unexpected says they are from IT, hang up and call your own helpdesk on a number you already hold.
What this means for Nigeria and Africa
There are no reports of this gang targeting African firms yet. The method, however, does not depend on geography. Nigerian law firms, banks, fintechs and consultancies hold client data of the same kind, and impersonating IT staff is a common fraud pattern. Offices with open-plan layouts and informal visitor rules are the easiest places for it to work. The defences above cost little: a visitor log, an escort rule and a USB policy.
How many firms were hit?
- How many offices were actually visited. Google did not give a number.
- Whether all the in-person visits come from this gang. Google calls the link likely, not proven.
- Whether the tactic is spreading beyond US legal and financial firms.
- Whether the in-person approach is new. Mandiant CTO Charles Carmakal told TechCrunch that Mandiant has investigated matters where adversaries planted insiders or bribed employees.
The weak point in this attack is a person letting a stranger sit at a desk. A written verification rule closes it.
