What the FBI Actually Described
On May 26, 2026, the FBI's Internet Crime Complaint Center reissued its warning about Silent Ransom Group, also tracked as Luna Moth, Chatty Spider, and UNC3753. The alert is the bureau's second on this actor in twelve months, and the additions are operational rather than rhetorical. The phone-and-email stages of the IT-impersonation chain are unchanged. What is new in Spring 2026 is that an operator now turns up in person when the remote stages do not succeed.
The chain reported by the FBI begins with a phishing message that asks the recipient to call a number staffed by the actor's fake help desk. If the call lands, the operator pressures the employee into opening a remote-support session and granting hands-on control of the workstation. If the call does not land, the alert describes a follow-on attempt in which a person visits the target's office, presents themselves as IT support responding to a recent phishing email, and asks to image or back up the affected machine. A storage device is inserted, and data leaves the building on it.
Law firms are the named victim set in the bureau's 2026 reporting. Public coverage at the time of the alert counted at least thirty-eight firms named on the group's leak site, with total intrusions reported to exceed one hundred. The group's monetization pattern remains data theft and extortion rather than encryption-first ransomware.
Why the In-Person Step Works
Help-desk impersonation is a procedural attack on identity verification. The chain succeeds when the target's environment has no scripted way to ask "are you who you say you are" outside the moment. The phone stage exploits the absence of a callback-on-a-known-number step. The remote-support stage exploits the absence of a ticket-first rule for unsolicited sessions. The in-person stage exploits a quieter assumption: that anyone in the building who says they are IT, is.
The pretext is engineered for that gap. The visitor's story refers to a phishing email the employee may actually have received, and the request is a routine one for IT in a crisis: image the device before something gets worse. The conversation does not ask the employee to do anything unusual. It asks them to step aside while the helper does their job. Refusing feels obstructive, not safe.
Law firms are a fit for this method for the same reasons they have been a fit for callback variants of it. Many are small enough that the staff cannot recognize every IT contractor by face. Many run a mixed estate of partner laptops, paralegal workstations, and document-management systems that an outsider can plausibly claim to need access to. The data on those devices, including matter records and client privileged material, gives the extortion stage real leverage.
Choke Points
Three controls already documented in defender writeups of the chain are the choke points that matter here.
First, callback verification on a known internal number breaks the phone stage. If the help desk expects every inbound report of a phishing email to be returned with a call out to a number printed on the badge or the intranet, the actor's pretext loses its anchor.
Second, ticket-first remote support breaks the screen-share stage. If the policy says an unsolicited remote-support session is not allowed without a ticket the user can verify, the path from inbox storm to remote control closes. We have written about that same principle in the [Storm-1811 vishing-to-Quick-Assist chain](/articles/storm-1811-teams-quick-assist-phishing-chain) and the [MuddyWater Teams screen-share method](/articles/muddywater-teams-screen-share-credential-theft-false-flag); the new SRG reporting is a third instance of why the principle is operational, not cultural.
Third, a front-desk visitor policy that requires verification with a named internal sponsor breaks the in-person stage. The visitor's story relies on the front desk treating "IT support, here for an emergency" as self-authenticating. A simple "let me call your sponsor to confirm" step kills the pretext the same way callback verification kills the phone stage. The principle is consistent across all three stages: the helper must be identified before they help, not after.
Telemetry and Evidence
The in-person stage is largely invisible to conventional security telemetry. Visitor-management systems, badge logs, and cameras may record the physical visit, but the SOC may not see the conversation in the conference room, and DLP may not fire when an authorized user copies their own files onto a thumb drive they trust. The signals that exist for security teams are usually pre- and post-visit.
Before the visit, the same phishing email and callback number that anchor the remote chain are usually present. Mail security tooling that flags impersonation lures, and reporting workflows that route those into a real ticket, will sometimes catch the pretext before the in-person step is needed. After the visit, the evidence is operational rather than technical: a workstation that recently mounted an unfamiliar removable device, a missing or rebuilt machine that no internal ticket explains, a partner asking why IT showed up unannounced.
Endpoint policies that block or audit USB mass-storage attachments on partner and high-sensitivity workstations turn the post-visit event into a signal. So does a written policy that requires the on-site IT team to be the only people who handle hardware imaging, with every off-cycle image tied to a ticket and a chain-of-custody record.
Where This Fits in the Tradecraft Picture
The pattern across Storm-1811, MuddyWater, the wider help-desk impersonation surge, and now SRG's 2026 escalation is a single one. Mature actors are looking for the points where identity verification is procedural rather than technical, and they are working those points one channel at a time. Email lures fail when the user reports and verifies. Voice calls fail when callback verification is enforced. Screen-share sessions fail when ticket-first rules hold. A walk-in fails when the front desk verifies sponsors before letting visitors past reception.
The instructive piece of SRG's update is not the novelty of the in-person step. It is that the actor decided the remote stages were closing fast enough to make the trip worthwhile. Defender practice that lifts the cost of the earlier stages will keep pushing the chain into channels that are harder to scale. The closer the attacker is to the building, the smaller the campaign and the higher the marginal cost of each successful intrusion.
For red teams running help-desk-impersonation exercises in 2026, the SRG alert is a reason to include a walk-in scenario in scope where it is safe and authorized to do so. For blue teams and operations leaders, it is a reason to ask the same identity-verification questions of the front desk and physical security team that already get asked of the SOC. The chain is the same chain. The only thing that changed is which door the operator knocked on.