{"id":4134,"date":"2026-06-27T11:03:51","date_gmt":"2026-06-27T11:03:51","guid":{"rendered":"https:\/\/relocationtimess.com\/?p=4134"},"modified":"2026-06-27T11:03:51","modified_gmt":"2026-06-27T11:03:51","slug":"when-cybercriminals-hire-burglars-inside-an-alleged-russian-effort-to-infiltrate-multibillion-dollar-us-law-firms","status":"publish","type":"post","link":"https:\/\/relocationtimess.com\/?p=4134","title":{"rendered":"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms"},"content":{"rendered":"
\n
\n

\n When an executive at a US law firm\u2019s phone rang in April, the voice on the other end was urgent: A computer virus was spreading through the firm.\n <\/p>

Read more After ousting Bill Cassidy, Donald Trump faces fresh test of his sway with GOP voters in Louisiana\u2019s Senate runoff<\/a><\/p>\n

\n The caller said they were from IT support and needed physical access to the lawyer\u2019s computer because remote fixes to stop the attack weren\u2019t working. The lawyer told his purported colleague to swing by his desk at the law firm\u2019s office in New Jersey.\n <\/p>\n

\n The next day, the firm\u2019s receptionist called: The lawyer had a visitor from IT at the front desk.\n <\/p>\n

\n \u201cThat\u2019s when an alarm bell went off: Why would an IT person need to check in with reception?\u201d said Leeann Nicolo, who handles incident response for cybersecurity insurance firm Coalition, which the law firm hired to investigate the incident.\n <\/p>\n

\n The visitor ran out of the building when the lawyer approached the front desk, according to Nicolo.\n <\/p>\n

\n It\u2019s one of several incidents at law firms across the country in the last year in which, and private investigators suspect, the Russian-speaking Silent Ransom Group has hired people in the US to show up in-person and plug thumb drives into law firms\u2019 computers. The physical access could help bypass anti-virus protections that the hackers run up against from afar.\n <\/p>\n

\n The group\u2019s millions of dollars in returns contrasts with its modest investments: In a private Telegram channel, the group is offering $500 to people to visit law firms and plug in USB sticks, one cybersecurity professional familiar with the incidents told CNN.\n <\/p>\n

\n The hired hands are \u201ccannon fodder\u201d for the Russian-speaking cybercriminals \u2014 expendable assets in a much larger cybercrime war, the source said. It\u2019s a rare and risky tactic for hackers to undertake because it leaves a trail of evidence, including surveillance footage, that the FBI can pore over.\n <\/p>\n

\n Cybercriminals \u201care getting increasingly bold in what they recruit people to do over the internet,\u201d a law enforcement official who tracks the group told CNN.\n <\/p>\n

\n The goal of these brazen operations is to strengthen the criminals\u2019 hands in multimillion-dollar ransom negotiations by obtaining sensitive data on the law firms\u2019 clients. If the firms don\u2019t pay up, the hackers leak the stolen information.\n <\/p>\n

\n Hacking alone has already netted Silent Ransom Group a fortune. They have extorted roughly $100 million from law firms in the last six months alone, according to an estimate from a cybersecurity executive who has facilitated ransom payments to the group. Other sources familiar with the group estimated it had extorted at least tens of millions of dollars.\n <\/p>\n

\n When hacking from afar doesn\u2019t yield enough data for a big score, the group has tried to up the ante by outsourcing burglary. Hired hands have visited major US cities, including New York and Washington, D.C., CNN has found.\n <\/p>\n

\n In another case, a man posing as IT support entered another US law firm and began speaking Russian into his smart glasses. That was likely intended to give the cybercriminal group a live look at the computers in the building, according to another cybersecurity researcher familiar with the case.\n <\/p>

Read more Trump ramps up attacks on Democrats as \u2018godless Communists\u2019 ahead of November\u2019s midterms<\/a><\/p>\n

\n Before the intruder reached the desk of the lawyer whose computer he wanted to compromise, another member of the crime group called the lawyer\u2019s cell phone, posing as a FedEx dispatcher to lure him away from this desk. The intruder plugged in the thumb drive, but the law firm\u2019s cyber defenses blocked the attack, the researcher said.\n <\/p>\n

\n \u201cMy expectation is that they\u2019re targeting every major law firm in the US,\u201d the cyber executive involved in payments to the group told CNN.\n <\/p>\n

\n Two crimes, one job\n<\/h2>\n

\n Silent Ransom Group is the only \u201cdata extortion group\u201d the FBI is aware of that is physically accessing the proprieties of its victims, the bureau said in a statement to CNN.\n <\/p>\n

\n There have been \u201cnumerous physical access attempts\u201d by Silent Ransom Group in cities across the US, the FBI said. It declined CNN\u2019s request for an interview with an FBI official focused on the cybercrime group.\n <\/p>\n

\n Other cybercriminals have posed physical threats before, from \u201cswatting\u201d (in which a caller triggers a massive police response) to threatening violence. But most government and private security experts are still not trained to deal with cyber and physical threats at the same time.\n <\/p>\n

\n \u201cMany threat actors have found it easier to conduct things completely digitally, and therefore (the physical aspect) may be a threat that we don\u2019t think about as much,\u201d said Genevieve Stark, head of cybercrime and information operations intelligence analysis at Google Threat Intelligence Group. \u201cIt may be a trend where individuals are more likely to trust someone who (shows up) in person because it\u2019s not expected\u201d\n <\/p>\n

\n
\n\n STREAMING NOW\n <\/span>\n<\/header>\n
\n
\n
\n
\n\n
\n
\"LP_SecretsSpies_Texted_Homepage_Feature_Card_1440x810.png\"<\/figure>\n<\/figure>\n\n<\/div>\n
\n
\n
\n
\n<\/div>\n
CNN<\/figcaption>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n

\nSpies and traitors play a dangerous game during the Cold War<\/span>\n<\/p>\n<\/div>\n<\/section>\n<\/div>\n

\n The Silent Ransom Group hackers are no strangers to the FBI. Cybersecurity researchers believe some of its members were involved in the infamous Conti ransomware gang that dissolved in 2022 after a Ukrainian man leaked thousands of the group\u2019s internal chat logs in retaliation for Russia\u2019s full-scale invasion of Ukraine. The leak included evidence that the hackers had connections with Russian intelligence.\n <\/p>\n

\n The FBI spent years gathering evidence on Conti and tracking its members\u2019 movements (one alleged member pleaded guilty in US court this month). The Ukrainian man told CNN that the FBI asked him to stop leaking the Conti files, apparently because it might interfere with the bureau\u2019s investigation. Now, the FBI is building a case against the Silent Ransom Group by tracking law firms\u2019 payments on the blockchain, multiple sources familiar with the investigation told CNN.\n <\/p>\n

\n The investigation isn\u2019t completely digital.\n <\/p>\n

\n Over the last year, at least two US law firms have received extortion letters in the mail demanding payment in cryptocurrency or cash not to leak data allegedly stolen from the firms, according to Nicolo, the executive with cyber insurance firm Coalition. The return addresses on the envelopes were empty offices in Washington, DC, and Boston, she said, calling it \u201ceerie.\u201d\n <\/p>\n

\n The letters were signed by a different cybercrime group, but Nicolo thinks it\u2019s a false flag. The forensics show that Silent Ransom Group hacked at least one of the firms, she said.\n <\/p>\n

\n \u201cI think we are going to see more and more of that,\u201d Nicolo said, referring to break-in attempts and other physical threats to victim organizations.\n <\/p>\n

\n \u201cIt\u2019s a fine line between hoping you get paid and\/or hacking enough victims that you\u2019re making money somewhere, and having to apply that next level of pressure,\u201d she said.\n <\/p>

Read more Trump posts new passport rendering \u2014 featuring a memorable photo of himself<\/a><\/p>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

When an executive at a US law firm\u2019s phone rang in April, the voice on the other end was urgent: A computer virus was spreading through the firm.<\/p>\n","protected":false},"author":1,"featured_media":4131,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-4134","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-politics"],"yoast_head":"\nWhen cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms - Relocation Times<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/relocationtimess.com\/?p=4134\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms - Relocation Times\" \/>\n<meta property=\"og:description\" content=\"When an executive at a US law firm\u2019s phone rang in April, the voice on the other end was urgent: A computer virus was spreading through the firm.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/relocationtimess.com\/?p=4134\" \/>\n<meta property=\"og:site_name\" content=\"Relocation Times\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-27T11:03:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/relocationtimess.com\/wp-content\/uploads\/2026\/06\/807323fe7866cc63d3bf04de2a35ac30.png\" \/>\n\t<meta property=\"og:image:width\" content=\"256\" \/>\n\t<meta property=\"og:image:height\" content=\"144\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/#\\\/schema\\\/person\\\/3d25fb966f660ab012820a9e0acc09be\"},\"headline\":\"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms\",\"datePublished\":\"2026-06-27T11:03:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134\"},\"wordCount\":1156,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/relocationtimess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c76d6b84804ca31a30a15f7bdb6a397f.jpg\",\"articleSection\":[\"Politics\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134\",\"url\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134\",\"name\":\"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms - Relocation Times\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/relocationtimess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c76d6b84804ca31a30a15f7bdb6a397f.jpg\",\"datePublished\":\"2026-06-27T11:03:51+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/#\\\/schema\\\/person\\\/3d25fb966f660ab012820a9e0acc09be\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/relocationtimess.com\\\/?p=4134\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#primaryimage\",\"url\":\"https:\\\/\\\/relocationtimess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c76d6b84804ca31a30a15f7bdb6a397f.jpg\",\"contentUrl\":\"https:\\\/\\\/relocationtimess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c76d6b84804ca31a30a15f7bdb6a397f.jpg\",\"width\":800,\"height\":450},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/?p=4134#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/relocationtimess.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/#website\",\"url\":\"https:\\\/\\\/relocationtimess.com\\\/\",\"name\":\"Relocation Times\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/relocationtimess.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/relocationtimess.com\\\/#\\\/schema\\\/person\\\/3d25fb966f660ab012820a9e0acc09be\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/relocationtimess.com\"],\"url\":\"https:\\\/\\\/relocationtimess.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms - Relocation Times","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/relocationtimess.com\/?p=4134","og_locale":"en_US","og_type":"article","og_title":"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms - Relocation Times","og_description":"When an executive at a US law firm\u2019s phone rang in April, the voice on the other end was urgent: A computer virus was spreading through the firm.","og_url":"https:\/\/relocationtimess.com\/?p=4134","og_site_name":"Relocation Times","article_published_time":"2026-06-27T11:03:51+00:00","og_image":[{"width":256,"height":144,"url":"https:\/\/relocationtimess.com\/wp-content\/uploads\/2026\/06\/807323fe7866cc63d3bf04de2a35ac30.png","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/relocationtimess.com\/?p=4134#article","isPartOf":{"@id":"https:\/\/relocationtimess.com\/?p=4134"},"author":{"name":"admin","@id":"https:\/\/relocationtimess.com\/#\/schema\/person\/3d25fb966f660ab012820a9e0acc09be"},"headline":"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms","datePublished":"2026-06-27T11:03:51+00:00","mainEntityOfPage":{"@id":"https:\/\/relocationtimess.com\/?p=4134"},"wordCount":1156,"commentCount":0,"image":{"@id":"https:\/\/relocationtimess.com\/?p=4134#primaryimage"},"thumbnailUrl":"https:\/\/relocationtimess.com\/wp-content\/uploads\/2026\/06\/c76d6b84804ca31a30a15f7bdb6a397f.jpg","articleSection":["Politics"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/relocationtimess.com\/?p=4134#respond"]}]},{"@type":"WebPage","@id":"https:\/\/relocationtimess.com\/?p=4134","url":"https:\/\/relocationtimess.com\/?p=4134","name":"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms - Relocation Times","isPartOf":{"@id":"https:\/\/relocationtimess.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/relocationtimess.com\/?p=4134#primaryimage"},"image":{"@id":"https:\/\/relocationtimess.com\/?p=4134#primaryimage"},"thumbnailUrl":"https:\/\/relocationtimess.com\/wp-content\/uploads\/2026\/06\/c76d6b84804ca31a30a15f7bdb6a397f.jpg","datePublished":"2026-06-27T11:03:51+00:00","author":{"@id":"https:\/\/relocationtimess.com\/#\/schema\/person\/3d25fb966f660ab012820a9e0acc09be"},"breadcrumb":{"@id":"https:\/\/relocationtimess.com\/?p=4134#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/relocationtimess.com\/?p=4134"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/relocationtimess.com\/?p=4134#primaryimage","url":"https:\/\/relocationtimess.com\/wp-content\/uploads\/2026\/06\/c76d6b84804ca31a30a15f7bdb6a397f.jpg","contentUrl":"https:\/\/relocationtimess.com\/wp-content\/uploads\/2026\/06\/c76d6b84804ca31a30a15f7bdb6a397f.jpg","width":800,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/relocationtimess.com\/?p=4134#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/relocationtimess.com\/"},{"@type":"ListItem","position":2,"name":"When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms"}]},{"@type":"WebSite","@id":"https:\/\/relocationtimess.com\/#website","url":"https:\/\/relocationtimess.com\/","name":"Relocation Times","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/relocationtimess.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/relocationtimess.com\/#\/schema\/person\/3d25fb966f660ab012820a9e0acc09be","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/relocationtimess.com"],"url":"https:\/\/relocationtimess.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/relocationtimess.com\/index.php?rest_route=\/wp\/v2\/posts\/4134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/relocationtimess.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/relocationtimess.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/relocationtimess.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/relocationtimess.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4134"}],"version-history":[{"count":0,"href":"https:\/\/relocationtimess.com\/index.php?rest_route=\/wp\/v2\/posts\/4134\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/relocationtimess.com\/index.php?rest_route=\/wp\/v2\/media\/4131"}],"wp:attachment":[{"href":"https:\/\/relocationtimess.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/relocationtimess.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/relocationtimess.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}