Cybersecurity experts are warning businesses about a new and alarming trend in ransomware attacks. According to recent alerts from Google and the FBI, a cybercriminal group known as the Silent Ransom Group is no longer relying solely on phishing emails and remote attacks. Instead, the group has reportedly started sending fake IT workers directly to company offices to gain access to sensitive systems and data.

This unusual tactic represents a significant evolution in cybercrime, blending traditional hacking methods with physical infiltration.

Fake IT Workers Are Being Used in Real-World Attacks

According to security researchers, members of the Silent Ransom Group have impersonated IT support personnel and attempted to enter company offices under the pretense of helping employees with technical issues.

Once inside, the attackers may:

  • Connect USB devices to company computers
  • Install remote access tools
  • Steal confidential business information
  • Gain unauthorized access to internal systems
  • Assist remote hackers in compromising networks

The FBI confirmed that it has investigated multiple incidents involving individuals pretending to be IT support workers to gain physical access to organizations.

Why Law Firms Are Being Targeted

The group has reportedly focused many of its attacks on law firms because they often store highly sensitive information, including:

  • Client contracts
  • Financial records
  • Tax documents
  • Personal identification data
  • Confidential legal communications

Cybercriminals view this information as valuable because it can be used for extortion, identity theft, or sold on underground marketplaces.

How the Scam Usually Begins

Security experts say these attacks often start with social engineering tactics.

Attackers may:

  1. Send phishing emails pretending to be company IT staff.
  2. Call employees claiming there is a technical issue.
  3. Request access to computers for troubleshooting.
  4. Convince users to install remote access software.
  5. Gain access to sensitive systems and data.

In some cases, if remote access attempts fail, attackers may escalate their efforts by physically visiting company offices.

A New Form of Ransomware Extortion

Unlike traditional ransomware attacks that encrypt files and demand payment for decryption keys, this group focuses heavily on data theft.

After stealing information, attackers threaten to publicly release the data unless a ransom is paid.

Victims may receive messages warning that their stolen files will be shared with employees, customers, business partners, or even published online if payment demands are ignored.

This strategy, known as data extortion, has become increasingly common because it allows criminals to pressure organizations without deploying traditional ransomware software.

Google Issues Warning

Google’s cybersecurity teams have identified multiple incidents involving the Silent Ransom Group during the first half of 2026.

Researchers noted that attackers continue to use a combination of:

  • Phishing campaigns
  • Phone-based social engineering
  • Screen-sharing applications
  • Remote access software
  • Physical infiltration attempts

The combination of digital and physical attack methods makes these operations particularly dangerous.

How Businesses Can Protect Themselves

Security professionals recommend that organizations strengthen both their cybersecurity and physical security measures.

Verify All IT Requests

Employees should always verify requests for technical support through official company channels.

Restrict Physical Access

Organizations should ensure that visitors, contractors, and support personnel are properly identified and authorized before accessing office spaces.

Train Employees Regularly

Security awareness training can help employees recognize phishing emails, suspicious phone calls, and social engineering attempts.

Limit USB Device Usage

Many organizations block unauthorized USB devices to reduce the risk of malware infections and data theft.

Use Multi-Factor Authentication

MFA adds an additional layer of protection even if attackers obtain login credentials.

Monitor Remote Access Tools

Companies should carefully track the installation and usage of remote desktop software and screen-sharing applications.

Why This Matters

Cybercriminals are constantly adapting their tactics. While phishing emails and malware remain common threats, attackers are increasingly combining digital techniques with real-world actions.

The recent warnings from Google and the FBI demonstrate that cybersecurity is no longer just an IT problem it is also a physical security challenge.

Businesses that focus only on digital defenses may still be vulnerable if employees unknowingly grant access to individuals pretending to be trusted support personnel.

Final Thoughts

The emergence of fake IT workers in ransomware campaigns highlights how sophisticated cybercriminal operations have become. By combining social engineering, physical access, and traditional hacking techniques, groups like the Silent Ransom Group are creating new risks for businesses worldwide.

Organizations should review both their cybersecurity policies and workplace security procedures to ensure employees know how to identify and report suspicious activity before it turns into a costly data breach.

Read More on VitalStack

Enjoyed this article?

Subscribe for weekly deep-dives on AI and health — straight to your inbox.