FBI warns of personal data theft attacks by extortion groups

The FBI warned on Tuesday that the extortion gang Silent Ransom Group (SRG) is presently concentrating on U.S.-based regulation companies with in-person knowledge theft assaults.

“As of spring 2026, SRG attackers are utilizing social engineering schemes to impersonate staff of victims’ IT departments. SRG attackers are making direct cellphone calls or sending phishing emails encouraging staff to name SRG attackers pretending to be IT assist,” the FBI warned in a Tuesday bulletin.

“Throughout the name, the SRG attacker instructs the worker to grant entry to a distant desktop session. If that try fails, SRG sends the attacker to the sufferer’s location and beneficial properties entry to insert a storage gadget into the sufferer’s laptop.”

A malicious attacker can go on to the sufferer’s location and join a USB drive or exterior arduous drive to the sufferer’s laptop to steal knowledge.

The FBI listed doable indicators of an SRG assault because the unauthorized set up of exterior arduous drives or USB drives on firm computer systems, and the presence of unidentified or unauthorized people trying to realize entry to computer systems underneath the guise of IT assist.

“SRG attackers set up entry to a sufferer’s laptop by posing as IT assist through cellphone name or phishing e mail, after which extract knowledge, sometimes by official distant entry instruments or by sending people on to the sufferer’s enterprise location to realize bodily entry to the pc,” the FBI added.

SRG will use the stolen knowledge to ship ransom emails to victims, threatening to promote it or put up it on leaked websites, in addition to name victims’ staff and prospects to strain them into negotiating ransom funds.

The cybercriminal group, also referred to as Luna Moth, Chatty Spider, and UNC3753, has been lively since not less than 2022 and has been concentrating on U.S. authorized and monetary establishments since early 2023.

As BleepingComputer beforehand reported, the identical group of attackers was additionally concerned within the BazarCall marketing campaign that offered preliminary entry to company networks in Conti and Ryuk ransomware assaults.

In March 2022, after Conti was shut down, they separated from the cybercrime syndicate and fashioned Silent Ransom Group (SRG), identified for knowledge theft and extortion actions following focused phishing assaults.

This week’s breaking information follows a Could 2025 FBI non-public trade discover warning that the identical extortion group has been concentrating on U.S. regulation companies with callback phishing and social engineering assaults for greater than two years.

A Could 2025 EclecticIQ report detailing the cybercrime group’s assaults on U.S. authorized and monetary establishments additionally discovered that attackers have been registering domains to “use typosquatting patterns to impersonate IT assist desks or assist portals for giant U.S. regulation companies and monetary providers firms.”