The FBI is warning that the Silent Ransom Group (SRG) is targeting law firms with IT-themed social engineering attacks and callback phishing emails.
SRG is a cybercriminal gang that demands ransoms in exchange for not leaking stolen data.
“SRG has been operating since 2022 and has primarily been known for their callback phishing emails, masquerading as well-known businesses who offer subscription plans,” the FBI explains.
“Typically, SRG phishing emails purport to charge small amounts of ‘subscription fees’ as they are less likely to generate immediate suspicion.
In order to cancel the fake subscription, the victim is instructed to call the threat actor who emails a link which downloads remote access software giving the actor access to their device or system. Once the actor has established persistent access, the threat actors will seek to identify valuable information to exfiltrate, before sending a ransom notice to the victim threatening to share the victim’s data if a ransom is not paid.”
The gang recently began impersonating IT departments to target employees, a technique that the FBI says “has been highly effective and resulted in multiple compromises.”
“As of March 2025, SRG was observed changing their tactics to calling individuals and posing as an employee from their company’s IT department,” the Bureau writes. “SRG will then direct the employee to join a remote access session, either through an email sent to them, or navigating to a web page. Once the employee grants access to their device, they are told that work needs to be done overnight.”
The FBI offers the following advice to help organizations thwart these attacks:
- Conduct staff training on resisting phishing attempts
- Develop and communicate policies surrounding when and how company’s IT will authenticate themselves with employees
- Maintain regular backups of company data
- Implement two-factor authentication for all employees
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
The FBI has the story.
This 26-page manual is packed with actionable info that you need to prevent infections, and what to do when you are hit with ransomware. You also get a Ransomware Attack Response Checklist and Prevention Checklist. You will learn more about:
