An extortion gang tracked as “Silent Ransom Group” is targeting US law firms with voice phishing and in-person social engineering attacks, according to researchers at Mandiant and Google’s Threat Intelligence Group (GTIG).

“UNC3753 leverages voice phishing (vishing) and social engineering deception techniques to achieve remote access into corporate environments,” the researchers write. “Using pretexts such as data migration or invoice-related emails, the threat actors initiate phone conversations posing as IT support and convince targets to host screen-sharing sessions and download remote monitoring and management (RMM) utilities. Once inside the environment, the threat actors either directly conduct searches to locate and exfiltrate highly sensitive data, or manipulate the victim into executing these actions on their behalf. This data typically includes proprietary legal agreements, personally identifiable information (PII), and financial records for subsequent extortion demands.”

Notably, if the voice phishing attempt fails, the gang sends an individual to physically infiltrate the company by posing as an IT worker. This individual attempts to gain access to computers inside the building and copy data to a USB drive.

“The onsite threat actor will claim they need to image the device or create local backups to address a security issue,” the researchers write. “Once they gain access to the endpoint, they attempt to exfiltrate corporate data directly to an external drive.”

The researchers recommend that organizations provide employee awareness training tailored to these techniques, as well as implement the following policies to prevent malicious actors from entering the building:

• “Require visitors to display official credentials and photo identification.
• “Require front-desk staff to copy and log all physical visitor IDs before granting access.
• “Verify the arrival of all technicians against pre-scheduled work orders directly with the verified parent organization or helpdesk dispatcher.
• “Enforce a policy requiring physical technical service personnel to be escorted by a corporate supervisor at all times.”

Google has the story: Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms