Fake IT Workers Are Hacking Offices In Person

Google and the FBI warn that a ransomware gang is sending fake IT workers into offices to physically steal company data.

Google and the FBI have issued a critical security alert about a ransomware group using a bold new tactic: physical infiltration. The gang, known as the Silent Ransom Group, sends operatives who pose as IT support staff to gain access to their targets' offices. According to the advisory, these impostors have successfully entered corporate environments, including law firms, by convincing employees they are there for legitimate maintenance or support tasks. Once inside, the attackers connect malicious USB drives to company computers or install remote access software. This allows them to bypass network security from within the trusted perimeter, exfiltrating sensitive data directly from the source. The strategy combines sophisticated social engineering with direct physical access, creating a blended threat that many organizations are not prepared to handle. It represents a significant evolution from purely digital ransomware attacks, which typically rely on phishing emails or software vulnerabilities to gain initial entry.

This development is a major concern for security teams and business leaders because it sidesteps many conventional cybersecurity defenses. Firewalls, email security gateways, and endpoint detection systems are designed to stop remote threats, but they offer little protection against an attacker who is physically present in the office and has been granted access to a workstation. The success of this method hinges on exploiting human trust and gaps in physical security protocols. It serves as a stark reminder that a company's security posture is not just about its digital infrastructure but also about its real-world procedures and employee awareness. Organizations must now re-evaluate their visitor verification processes, protocols for unscheduled IT support, and employee training on how to identify and report suspicious activity. The warning from federal law enforcement and a major tech company underscores the credibility and severity of this emerging threat, signaling that all businesses should review their defenses against both digital and physical intrusion.