Leaked internal chats from a Russia-based extortion gang show its members planning something most small firms never defend against: sending real people into victim offices to copy files off computers. The Record reviewed the archive, which spans August 2025 through September 2026 and includes negotiations with named victims, many of them US law firms. In one of those negotiations, the firm told the extortionists it knew someone had walked into its New York office and copied files onto a flash drive. The gang’s own plans included buying delivery uniforms and insulated bags so an operative could get past reception with a pizza order, then pose as an IT worker once inside.
Chainalysis tied cryptocurrency addresses in the leak to extortions by the group tracked as Silent Ransom Group, also called Luna Moth. The FBI had already issued a flash alert this year warning that members of the group were posing as IT personnel to get physical access to computers. So the pizza thing is not a fantasy posted by someone showing off. Part of it is operational.
If you run a professional services firm, this is the uncomfortable version of a threat you already knew about. Your data is worth money to someone, and the cheapest path to it may be a guy in a polo shirt who says he is here about the printer.
Seven things to do about it
1. Make “nobody from IT shows up unannounced” an actual rule. Write it down and tell every person who sits near the front. All IT visits are scheduled in advance, in writing, by a named person at your firm. If someone arrives claiming to be from your IT provider and nobody has an email about it, the answer is “have a seat” followed by a phone call to the number you already have on file. Not the number on the visitor’s business card.
2. Stop unescorted access past the lobby. Deliveries get handed off at the desk. Vendors get walked to where they are going and walked back out. Keep a visitor log with a name, a company, a time in and a time out. This sounds like 1998 office management because it is, and it is exactly the control the attack is designed to slip past.
3. Lock the USB ports. Most of this attack collapses if a flash drive does nothing when it gets plugged in. Endpoint software can block USB mass storage outright or allow only approved devices, and it logs the attempt either way. Device control is standard in modern endpoint tools, including the ones we deploy for clients. If you have never checked whether yours is turned on, that is this week’s task.
4. Set screen locks to five minutes and require a password to wake. An empty conference room with a signed-in laptop is the entire opportunity. Five minutes of idle time, lock, full-disk encryption on every machine so pulling the drive gets nothing. BitLocker on Windows, FileVault on Mac, enforced by policy, not by asking people nicely.
5. Tell your staff what your help desk will never do. Real IT does not call you out of the blue and ask for your password, your MFA code, or permission to install something while you wait. Same rule applies on the phone, on Teams, and in person. We wrote about the online version of this when attackers started running fake IT help desk sessions over Teams. The physical version uses the same script and the same trust.
6. Limit who can touch everything. The reason a few minutes at a workstation is worth millions is that one logged-in account often reaches every client file in the firm. Cut that. Case files by matter, accounting separate from legal, admin accounts separate from daily-use accounts. Then turn on alerting for bulk file access, so somebody gets a notification when one account pulls three thousand documents in four minutes at 6:40 on a Friday.
7. Decide now who you would call, and who you would not. This is a data theft and extortion crew, which means backups do not save you. Only limiting what can be stolen does. And when the demand arrives, the worst moment to pick a recovery vendor is the moment you need one. Last week the DOJ charged the owner of ransomware recovery firm MonsterCloud with wire fraud, alleging he quietly paid ransoms and billed victims far more, in one case paying $8,200 and charging the client $150,000. Pick your incident response contact, your cyber insurance carrier’s hotline, and your outside counsel while nothing is on fire.
What we handle
For clients, device control and USB policy, screen lock and encryption enforcement, permission cleanup so one account cannot reach the whole file server, and bulk-access alerting all live inside what we manage day to day. The front desk rules and the visitor log are yours. They cost nothing and they are half the defense here.
If you are a law office, accounting firm, or medical practice sitting on client data and you have never looked at any of this, that is a normal place to be. Book a free 15-minute consult and we will tell you honestly which of these seven you already have.