The FBI has issued a formal warning about the Silent Ransom Group, an extortion crew that has added a genuinely unusual tactic to its playbook: turning up at US law firms in person, impersonating tech support staff, and physically plugging in USB drives to steal data directly from workstations.

This isn't a theoretical attack scenario. The FBI says SRG operatives have successfully talked their way past reception desks, sat down at employees' computers, and exfiltrated sensitive legal files — all while pretending to be there to fix something. It's social engineering, except the "link" they're convincing you to click is a thumb drive, and the person asking is standing right next to you.

Why law firms? They sit on extraordinarily sensitive data — litigation strategy, M&A deal terms, client financial records, sealed court documents. They're also historically under-resourced on security relative to financial services or government, and their cultures tend to prize client access over friction. A visitor who looks plausibly like an IT contractor is often waved through.

SRG's hybrid approach combines conventional remote access techniques with in-person intrusion. Researchers at the Record note the group is not particularly prolific, but has demonstrated a focused, methodical approach to the legal sector. The FBI advisory specifically calls out "social engineering schemes to gain remote access" alongside the physical visits — suggesting the crew adapts its method to whatever gets them inside.

The Australian angle here is real. This week, separately, iTnews reported that Australian cyber teams are actively reviewing data security controls after court transcription work was offshored — raising concerns about what investigative and legal records are accessible outside Australian jurisdiction, and to whom. The two stories aren't connected, but together they paint a picture of the legal sector as genuinely underdefended territory, where the threat model now extends well beyond a phishing email.

What should legal organisations do? The basics matter more than ever: visitor management that actually checks credentials against a known list, workstation lockouts that activate in under a minute of inactivity, and USB port controls (most endpoint security platforms can block unauthorised removable media). But the harder fix is cultural — the instinct to be helpful to someone who says they're from IT needs to be trained out.

What to watch: Whether SRG activity spreads beyond US law firms. The group's tactics require physical proximity, which suggests they'll focus on high-value English-speaking common-law jurisdictions — the UK, Canada, and Australia are all plausible next targets. Australian law firms that handle government, defence, or resources-sector work would be particularly attractive.

The ACSC's published guidance on physical security controls for organisations handling sensitive data is a reasonable starting point for any firm that hasn't revisited its visitor policies lately.