# Physical Access Risks: FBI Warns of In-Person USB Attacks by SRG > FBI alerts law firms of Silent Ransom Group operatives using physical social engineering and USB drives to infiltrate networks and exfiltrate sensitive data. - Published: 2026-05-27T09:17:34.000Z - Severity: high - Category: Threat Intel - Tags: Silent Ransom Group, Luna Moth, Physical Security, Law Firms, USB Malware - Author: Runtime Rebel Intel - Primary source: https://www.securityweek.com/fbi-hackers-sending-operatives-in-person-to-insert-usb-drives-and-steal-data/ - Canonical: https://runtimerebel.com/blog/physical-access-risks-fbi-warns-of-in-person-usb-attacks-by-srg ## Key points - Law firms face data theft from in-person operatives who bypass digital perimeters to deploy malware via physical USB drives. - Legal sector workstations and servers are targeted via physical access points and social engineering tactics. - Organizations must restrict physical USB port access and implement strict visitor verification protocols to prevent unauthorized hardware connection. The Federal Bureau of Investigation (FBI) has issued a specialized alert regarding a tactical shift by the Silent Ransom Group (SRG), also known as Luna Moth. According to [SecurityWeek](https://www.securityweek.com/fbi-hackers-sending-operatives-in-person-to-insert-usb-drives-and-steal-data/), this threat actor is moving beyond traditional [Phishing](/glossary#phishing) and remote exploitation to employ physical social engineering. The campaign specifically targets law firms, with operatives physically entering premises to insert malicious USB drives directly into workstations or servers to facilitate data exfiltration. ## Physical Social Engineering and In-Person Infiltration Historically, the [TTP](/glossary#ttp) of sending physical operatives to a target location has been the domain of high-tier intelligence agencies or specialized penetration testing teams. However, the Silent Ransom Group is now leveraging this method to bypass traditional network defenses. By gaining physical access, the group eliminates the need to defeat perimeter firewalls or sophisticated [EDR](/glossary#edr) solutions that focus on remote entry points. This strategy highlights a significant [Zero Trust](/glossary#zero-trust) failure where internal physical environments are often less scrutinized than external digital ones. The operatives reportedly masquerade as delivery personnel, maintenance workers, or other trusted visitors to gain entry to law firm offices. Once inside, they seek out unattended computers or exposed server ports. The goal of this [Silent Ransom Group law firm targeting](/glossary#ransomware) is typically the theft of sensitive legal documentation, intellectual property, or client data which can then be used for extortion. ## How to Detect Silent Ransom Group USB Attacks Detecting a physical breach requires a fusion of physical security monitoring and endpoint telemetry. From a technical perspective, a [SOC](/glossary#soc) should monitor for the sudden connection of unauthorized Hardware Interface Devices (HID) or removable storage. While no specific [CVE](/glossary#cve) is uniquely associated with the USB hardware itself in this alert, the payloads often utilize automated scripts to establish a [C2](/glossary#c2) channel. Defense teams should look for the following [IoC](/glossary#ioc) patterns and behaviors: * Unexpected PowerShell or Command Prompt execution immediately following a USB insertion event. * Modification of registry keys related to mounted devices or autorun settings. * External network connections to known malicious domains or IP addresses associated with SRG infrastructure. * Unusual [Lateral Movement](/glossary#lateral-movement) within the network shortly after an unverified visitor was on-site. When defenders attempt to [detect Silent Ransom Group USB attacks](https://www.securityweek.com/fbi-hackers-sending-operatives-in-person-to-insert-usb-drives-and-steal-data/), they must also analyze physical access logs. Correlating the timestamp of a suspicious USB event with building access badge logs or CCTV footage is essential for confirming the presence of an in-person operative. ### Mitigating Physical Access Threats and USB Malware To effectively combat this threat, organizations must move beyond digital-only security models. The following measures are recommended to harden the environment against physical infiltration: 1. **Port Security:** Physically block unused USB ports or use software-defined policies to disable USB storage devices globally across the workstation fleet. 2. **Visitor Management:** Implement rigorous identity verification for all visitors, including third-party contractors and delivery staff, ensuring they are escorted at all times. 3. **Endpoint Hardening:** Ensure that [EDR](/glossary#edr) policies are configured to alert on any device mounting that occurs while a workstation is in a locked state or during non-business hours. 4. **Hardware Awareness:** Educate employees on the risks of 'lost' USB drives or individuals attempting to access hardware under false pretenses. This shift by SRG indicates that even if an organization has a mature digital security posture, the physical layer remains a viable [Zero-Day](/glossary#zero-day) entry point if left unprotected. By [mitigating physical access threats and USB malware](https://www.securityweek.com/fbi-hackers-sending-operatives-in-person-to-insert-usb-drives-and-steal-data/), law firms can protect the confidentiality of their clients and reduce the likelihood of a successful extortion attempt. **Related:** [YellowKey: Bypassing Windows 11 BitLocker TPM Protections](/blog/yellowkey-bypassing-windows-11-bitlocker-tpm-protections), [Privacy Risks of Meta AI Glasses: Bluetooth Detection Strategies](/blog/privacy-risks-of-meta-ai-glasses-bluetooth-detection-strategies) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/physical-access-risks-fbi-warns-of-in-person-usb-attacks-by-srg