A cyber attack does not always start with a scary email, a strange attachment or a screen full of red warning messages. Sometimes it starts with a phone call.
“Hi, it’s IT. We’ve spotted a problem with your laptop. Can you open Quick Assist for me?”
That sounds ordinary. Helpful, even and that is exactly why it works.
The FBI has issued a notice about Silent Ransom Group, also known as Luna Moth, Chatty Spider and UNC3753. The group has been targeting law firms using social engineering, phone calls, phishing emails and fake IT support approaches. The same notice says the group has also affected organisations in insurance, finance and healthcare.
This is worth paying attention to if you run a small business, school, care provider, charity, parish council or professional services firm.
Because this attack does not rely on someone being careless – it relies on someone being helpful.
The attack does not always look like ransomware
When people think about ransomware, they often picture files being encrypted, systems being locked and a ransom note appearing on screen.
That still happens, but Silent Ransom Group works differently.
According to the FBI, the group carries out data theft and extortion without relying on traditional ransomware encryption. The aim is fast access, quick data theft and then pressure through threats to publish or sell the stolen information.
Your systems may still appear to be working. Staff may still be able to open files. Emails may still send. Nothing may look “locked”, but the data may already have gone.
We have already seen this pattern in recent UK attacks
This is not just an American law firm problem.
Recent UK cyber attacks have shown how damaging social engineering can be when attackers target the people and processes around IT support.
Marks & Spencer confirmed it suffered a cyber attack in 2025, and the incident caused major disruption to online orders, contactless payments, Click and Collect, gift cards and store operations. The Guardian reported that the attack had affected IT systems for more than a week, led to product shortages in some stores, and wiped hundreds of millions of pounds from the company’s market value.
M&S, Co-op and Harrods were all affected by cyber incidents within a short period. The National Cyber Security Centre confirmed it was working with organisations affected by recent retail incidents and providing advice to the wider sector. Reuters also reported that Harrods became the third major UK retailer targeted in a two-week span, after M&S and the Co-op.
The important lesson for smaller organisations is simple – If attackers are willing to go after the helpdesk and support processes of major UK retailers, they will not think twice about calling a school office, care provider, accountancy firm, parish council or small business and pretending to be from IT.
They may not need to “hack” their way in. They may just need one person to believe the call is genuine.
That is why the FBI notice is important. Silent Ransom Group has been using phone calls, phishing emails and fake IT support approaches to get remote access, steal data and then extort the victim. In some cases, the FBI says the group may even send someone in person to the victim’s location to gain physical access to a computer.
The pattern is simple.
Someone sounds official.
They create urgency.
They ask for access.
They use a legitimate tool.
The data leaves quietly.
For a small organisation, the lesson is not “be suspicious of everyone”.
It is: make verification normal. Staff should feel completely comfortable saying:
“I’m happy to help, but I need to verify this through our usual IT contact first.”
A genuine IT provider will understand. A criminal will push back.
How the fake IT support call works
The FBI notice describes attackers posing as members of the victim’s own IT department.
They may call directly. They may send a phishing email designed to make the employee call them. Once they have the person on the phone, they guide them into opening a remote desktop session.
That is the dangerous bit. Remote access tools are not automatically bad. Many genuine IT providers use them every day to support clients.
The problem is not the tool. The problem is who is controlling the session.
Once the attacker has access, the FBI says they may quickly move to data exfiltration rather than encryption. Tools mentioned in the notice include WinSCP and hidden or renamed versions of Rclone. The group has also used services such as Microsoft OneDrive and Google Drive to move stolen data.
That makes this hard for a normal member of staff to spot.
A real-looking call.
A familiar support tool.
A calm voice.
A believable reason.
No drama. No Hollywood hacking. Just someone being talked through the wrong action.
The in-person visit makes this even more uncomfortable
The FBI notice also includes something many businesses will not expect.
If the remote access attempt fails, the attacker may send someone to the victim’s location. That person claims they need physical access to image a device or create a backup file because of a phishing email. The FBI says this can involve inserting a storage device into the victim’s computer.
That sounds bold.
But think about how many organisations work in real life.
A busy reception desk.
A shared office.
A school office at morning drop-off.
A care home with visitors coming and going.
A small business where everyone is trying to keep the day moving.
If someone turns up wearing a lanyard, holding a laptop bag and saying “I’m here from IT”, would your team know exactly what to do?
Would they check?
Would they feel awkward challenging them?
Would they know who to call?
That is where policy matters. Not a 40-page document nobody reads. A simple rule people can remember.
No unexpected IT visit gets access to a computer until it has been verified through a known contact.
Not the phone number the visitor gives you. Not the email address they show you. A known number or named contact already held by your organisation.
Why antivirus may not save you
This is the part many small organisations miss.
The FBI warns that recent Silent Ransom Group campaigns left few artefacts on compromised machines, and that traditional antivirus products are unlikely to flag the intrusion because the group often uses legitimate remote access or system management tools.
That does not mean antivirus is pointless. It means antivirus is not a full plan.
If someone is persuaded to allow remote access, the activity may look like normal support. If data is moved to a cloud storage service, it may not look like malware. If an external drive is plugged in by someone standing in the office, the laptop may simply see a USB device.
This is why businesses need a mix of controls.
People need to know what “normal IT support” looks like.
Devices need sensible restrictions.
Remote access tools need controlling.
MFA needs to be used properly.
Backups still matter.
Monitoring helps spot the odd behaviour that a basic antivirus product may miss.
Warning signs to look for
The FBI lists several possible indicators, including unexpected downloads of remote access tools such as Zoho Assist, Quick Assist, AnyDesk, RustDesk, Syncro, Splashtop or Atera. It also mentions unauthorised USB or external hard drive use, data leaving the organisation, WinSCP or Rclone connections to external IP addresses, and people claiming to be IT support when they are not known or expected.
For most small organisations, I would turn that into plain English:
Someone asks to remote into your machine and you were not expecting it.
Someone says they are from IT but cannot be verified through your normal route.
Someone asks you to install a tool you do not normally use.
Someone turns up and wants to plug a USB drive or hard drive into a work computer.
Someone pressures you to act quickly, keep it quiet or not check with anyone else.
That last one matters. Real IT support should not mind being checked.
What small organisations should do now
The FBI recommends clear policies on how IT support will communicate and authenticate themselves to staff. It also recommends staff training, regular backups, phishing-resistant MFA where possible, and disabling remote access and external drive installation permissions on computers that access sensitive or confidential data.
For most schools, care providers and small businesses, I would start with five simple steps.
Create a “known IT contact” rule. Staff should know who provides IT support, how they normally make contact, and how to verify anything unexpected.
Block unauthorised remote access tools. If your business only uses one approved support tool, staff should not be able to install five others on a whim.
Restrict USB storage where possible. Especially on machines used for finance, HR, safeguarding, client records, patient information or management accounts.
Train staff with real examples. Not fear-based slides. Just simple scenarios: “Someone calls saying they are IT. What do you do?”
Make reporting easy. A member of staff should be able to say “this felt odd” without worrying they will be blamed.
The real lesson
This is not about telling staff they are the problem. They are not.
The problem is that criminals have learned how offices, schools and care settings actually work. They know people want to be helpful. They know people are busy. They know “IT support” is one of those phrases that makes people comply before they think.
So we need to make the safe action easier.
A fake IT support call should not become a data breach because someone was polite.
An unexpected visitor with a USB stick should not get near a work computer because nobody wanted to make a fuss.
Cyber security is often talked about as if it is all firewalls, acronyms and dark rooms full of screens.
Sometimes it is much simpler.
It is a receptionist knowing who to call.
It is a finance assistant refusing an unexpected remote session.
It is a care home manager checking before allowing access to a laptop.
It is a school office feeling confident enough to say: “Please wait there while I verify this.”
That one pause can make all the difference.
