FBI Warns of Cybercriminals Posing as IT Support to Steal Data

The FBI has issued a warning about the Silent Ransom Group, a cybercrime organization also known by aliases such as Luna Moth, Chatty Spider, and UNC3753. This group is reportedly targeting U.S. businesses, with a particular focus on law firms, by impersonating IT support personnel.

The modus operandi involves initial contact through phone calls or phishing attempts, aiming to persuade employees to install remote access software. When these methods fail, the group may resort to a more direct approach, with individuals showing up at the business premises in person.

In-Person Scams

According to the FBI, these impostors may arrive at offices presenting themselves as technicians needing to perform updates, troubleshoot issues, or check devices. They often come equipped with flash drives, external hard drives, and other equipment. Once granted access to a workstation, they can covertly copy sensitive files, expand their access to the network, and potentially leave behind malware.

"A fake IT support visit can look routine until sensitive files are copied from a company computer," the FBI noted.

Targeting Law Firms and Sensitive Data

Law firms are considered prime targets due to the highly sensitive nature of the information they handle, including client records, legal documents, financial details, and confidential negotiations. The Silent Ransom Group appears to prioritize data theft, using the compromised information for extortion by threatening to sell it or release it publicly. They may also contact employees or clients directly to increase pressure on the company to pay. This tactic can lead to public shaming and reputational damage for the victimized organization.

While law firms are a focus, the FBI cautions that any business handling sensitive records, such as medical offices, financial institutions, and insurance companies, could be at risk. The attackers leverage the trust employees place in individuals claiming to be from IT to gain access.

Exploiting Trust and Workplace Habits

These scams are effective because they subvert typical workplace expectations. Employees may assume an IT visitor has been pre-approved or is there to resolve a legitimate problem. The attackers exploit politeness and the desire for prompt technical assistance. Warning signs include surprise IT visits without a scheduled ticket, refusal to identify their referrer, requests to use a computer unsupervised, or bringing their own external storage devices.

Attackers often create a sense of urgency to bypass normal security protocols. They might claim immediate attention is required for a security update or a problem affecting the entire office, pressuring employees to act quickly.

Protective Measures

To counter these threats, the FBI and security experts recommend several measures:

• Verify all IT visits: Always confirm the identity and purpose of any IT personnel by contacting the company's official IT department through a known number, not one provided by the visitor.
• Require visible approval: Implement a policy where outside technicians need explicit approval from a manager or IT lead via an official channel before accessing any workstation.
• Restrict external storage: Limit the use of USB drives and external storage devices where possible, or restrict access to only approved devices.
• Employee training: Conduct security awareness training that includes in-person scam tactics, not just digital threats. Employees should feel empowered to challenge unexpected visitors.
• Monitor remote access tools: IT departments should monitor for and review the use of remote desktop management software, ensuring it is authorized.
• Limit file access: Enforce the principle of least privilege, ensuring employees only have access to the files necessary for their roles.
• Implement robust logging: Use strong logging and endpoint monitoring to track device connections, file transfers, and system changes, which can help detect suspicious activity.
• Front desk security: Establish a clear checklist for receptionists or office managers to verify unexpected visitors, including ID, company, and purpose.
• Report suspicious activity: Encourage prompt reporting of any impersonation attempts to management, IT, and potentially law enforcement or the FBI's Internet Crime Complaint Center (IC3.gov).
• Use security software: Maintain up-to-date security software on all computers to help detect malware and other threats, though this should complement, not replace, other security protocols.