The Silent Ransom Group has been posing as IT employees to gain access to organizations’ devices and networks, targeting industries including healthcare, the FBI warned.
The threat actors, who have been active since at least 2022 and don’t use encryption, historically sent phishing emails but since this spring have begun impersonating members of victims’ IT departments, calling or emailing employees to urge them to call IT support and grant remote desktop access, according to the May 26 notice. If that doesn’t work, they have been sending threat actors to victims’ locations to say they need to insert a storage device into their computers to address the effects of a phishing email.
“Unlike conventional ransomware actors, SRG actors typically seek rapid access to victim systems, immediate data exfiltration, and extortion through threats of public disclosure or sale of stolen data,” the FBI wrote.
The cybercriminal group, aka Chatty Spider, Luna Moth or UNC3753, has consistently targeted law firms but also healthcare, insurance and finance organizations. The FBI recommends reporting this type of activity to the agency and instituting policies on when and how IT support staffers will communicate and authenticate themselves to employees, adopting remote access safeguards, and verifying the credentials of all individuals accessing your organization’s physical spaces.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.