FBI Warns of New Cyber Threat: In-Person USB Drive Attacks

Post Views: 109

Law Firms Targeted by Sophisticated Cybercrime Gang

The Federal Bureau of Investigation (FBI) has issued a warning about a highly skilled extortion gang known as Silent Ransom Group (SRG). Since at least 2023, this group has been targeting law firms in the United States, primarily using phishing emails and social engineering phone calls.

Method of Attack

According to the FBI, SRG initially used callback phishing emails containing links to remote access software that allowed them to rapidly extract data from the victims’ systems. However, the group has updated its tactics this year, with attackers now posing as employees from the victim’s own IT department. They instruct victims to grant access to their machines through remote desktop sessions, and if that fails, send someone to install a device into the computer.

Consequences of the Attack

Once access is gained, the attackers escalate their privileges and immediately start extracting sensitive information. SRG employs legitimate system management or remote access tools to execute the assault, making it challenging for standard antivirus software to identify the threat. The group then threatens to sell or publish the stolen data online, contacting the victims’ employees and clients to increase the pressure.

Mitigation Strategies

Backing Up Company Data

The FBI suggests that companies back up all data to prevent permanent loss in case of an attack. This strategy ensures that even if the attackers gain control of the main system, they will not be able to permanently delete valuable data.

Implementing Phishing-Resistant MFA

Experts advise that companies implement phishing-resistant multi-factor authentication (MFA) to prevent attackers from gaining unauthorized access to the system. MFA adds an extra layer of security by requiring users to provide additional verification beyond just a password.

Blocking Access to Commonly Exploited Ports

It is recommended to block access to commonly exploited ports to limit the potential entry points for attackers. By limiting access to certain ports, companies can significantly reduce the risk of a successful attack.

Disabling Remote Access and Permissions for External Drive Installation

Companies should disable remote access and permissions for external drive installation to prevent attackers from accessing sensitive data. This measure ensures that even if an attacker gains access to the system, they will not be able to install malicious software or steal sensitive information.

Expert Recommendations

Experts suggest that companies enhance data center security without compromising performance and reassess the role of the Security Operations Center (SOC) in light of the increasing complexity of cyber threats. Adopting agent-centric security solutions and prioritizing business continuity planning can help organizations protect themselves against the evolving threat landscape.

Moreover, experts stress the importance of third-party risk management, patch management, and post-incident forensics in reducing the risk of cyber attacks. By staying informed and adapting to the latest threats and technologies, organizations can remain ahead of the curve and maintain the trust of their customers and stakeholders.