FBI flash alert: Silent Ransom Group (Luna Moth/UNC3753) sends operatives in person to plug USB drives into US law firm computers

The FBI has issued a flash alert warning that the Silent Ransom Group (also tracked as Luna Moth, Chatty Spider, and UNC3753) is now sending operatives physically to US law firms to steal data. SRG actors first pose as internal IT over phone or phishing email and try to get an employee to grant a remote-desktop session; if that fails, they dispatch someone in person to plug a USB drive or external hard drive into the target's computer. The group, formed from Conti/BazarCall operators after the 2022 Conti shutdown, has targeted US legal and financial firms since 2023, extorting victims via its leak site.

Check

Brief reception and staff at law/finance firms: verify any in-person 'IT support' visit through a known internal channel before granting access. Alert SOC to unexpected USB-storage mounts.

Affected

US law firms and financial-services organizations. SRG poses as internal IT via phone/phishing, escalating to physical USB-drive theft if remote-access social engineering fails.

Fix

Enforce device-control policy blocking unauthorized USB mass storage. Require multi-channel verification for IT-support remote-access requests. Lock workstations and restrict physical access. Run callback-phishing awareness training.