The Physical Breach Era

The transition from remote phishing to on-site physical impersonation by the Silent Ransom Group (SRG) marks a critical evolution in corporate threat vectors. Relying on digital-first perimeter defenses is no longer sufficient when adversaries treat physical office access as a standard social engineering play.

What Happened

The Silent Ransom Group, an Russia-linked actor also known as Luna Moth or UNC3753, is actively dispatching operatives to impersonate IT support personnel at target offices. These individuals use the guise of “device imaging” or “security patching” to gain physical terminal access. Once inside, they employ USB drives and remote-access software to exfiltrate sensitive data directly, bypassing network-based intrusion detection systems. This campaign primarily targets US-based law firms, exploiting the high sensitivity of their client data to secure extortion payments.

Why It Matters

First-order: Operational security at physical offices is effectively compromised for firms with high-value IP or PII. Standard “work from home” security protocols do not protect against an actor walking through the front door with a fake ID badge.

Second-order: Service providers and vendors who require periodic on-site access are now major liability nodes. Enterprises must immediately overhaul badge-in protocols and vendor verification processes, as the “IT support” social engineering script is being weaponized in the physical world.

Third-order: We are entering a phase where physical security and cybersecurity must unify their response protocols. Expect a shift toward “Zero Trust” physical access, where even internal staff are required to authenticate via secondary channels before hardware is accessed, regardless of the individual’s claimed authority.

The Numbers

  • 6% of all global ransomware attacks in Q1 2026 targeted law firms (Source: Halcyon).
  • 77% of ransomware intrusions in 2025 involved data exfiltration, up from 57% in 2024 (Source: Industry trend report).
  • $5.08M is the average cost of a data breach for law firms, reflecting a 10% YoY increase (Source: Market data).

What To Watch

  • Credential Hardening: Expect a rise in mandatory digital identity verification (e.g., QR-based badge authentication) for all physical IT maintenance tasks within the next 90 days.
  • Supply Chain Vetting: Firms will likely move toward “white-listed” contractor lists where every physical technician is verified through a pre-coordinated, out-of-band communication before entry.
  • Insurance Adjustment: Cyber insurance premiums for firms with physical offices may soon become contingent on updated physical-access policies and employee-specific training for impersonation attempts.