FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data

If the attempt fails, however, they send an individual posing as IT support in person to insert a device into the computer.“In this scheme, the threat actor tells the victim they need to image the device or create a backup file to address potential impacts from the phishing email,” the FBI explains.After gaining access to the machine, the attackers escalate their privileges and immediately proceed to exfiltrating data, without deploying file-encrypting ransomware.For data exfiltration, SRG uses WinSCP (Windows Secure Copy), or a version of Rclone. In some instances, they copy the data to internal file-sharing platforms, including Google Drive and Microsoft OneDrive.“By sending someone in-person to the victim’s location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim’s computer,” the FBI notes.The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

“In this scheme, the threat actor tells the victim they need to image the device or create a backup file to address potential impacts from the phishing email,” the FBI explains.After gaining access to the machine, the attackers escalate their privileges and immediately proceed to exfiltrating data, without deploying file-encrypting ransomware.For data exfiltration, SRG uses WinSCP (Windows Secure Copy), or a version of Rclone. In some instances, they copy the data to internal file-sharing platforms, including Google Drive and Microsoft OneDrive.“By sending someone in-person to the victim’s location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim’s computer,” the FBI notes.The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

After gaining access to the machine, the attackers escalate their privileges and immediately proceed to exfiltrating data, without deploying file-encrypting ransomware.For data exfiltration, SRG uses WinSCP (Windows Secure Copy), or a version of Rclone. In some instances, they copy the data to internal file-sharing platforms, including Google Drive and Microsoft OneDrive.“By sending someone in-person to the victim’s location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim’s computer,” the FBI notes.The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

For data exfiltration, SRG uses WinSCP (Windows Secure Copy), or a version of Rclone. In some instances, they copy the data to internal file-sharing platforms, including Google Drive and Microsoft OneDrive.“By sending someone in-person to the victim’s location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim’s computer,” the FBI notes.The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

“By sending someone in-person to the victim’s location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim’s computer,” the FBI notes.The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

The group then extorts the victim, threatening to sell or publish the stolen data online. The threat actor also contacts the victims’ employees and clients to increase the pressure.“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

“Recent SRG campaigns left few artifacts on compromised machines. Traditional antivirus products are also unlikely to flag the intrusion because SRG generally uses legitimate system management or remote access tools to carry out the attack,” the FBI’s alert reads.To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

To prevent SRG attacks, organizations are advised to verify the credentials of all individuals with access to company assets, limit access to sensitive data, train employees to identify phishing attempts, and establish clear policies for IT support communication and authentication.Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

Backing up all company data, implementing phishing-resistant multi-factor authentication (MFA), blocking access to commonly exploited ports, and disabling remote access and permissions for external drive installation should also prevent intrusions and the loss of sensitive and confidential data.Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

Related:185,000 Likely Impacted by 7-Eleven Data BreachRelated:Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register EntriesRelated:West Pharmaceutical Services Hit by Disruptive Ransomware AttackRelated:Ransomware Group Takes Credit for Trellix Hack

Source: SecurityWeek