When Physical Access Meets Kernel-Level File Control
The Silent Ransom Group has extorted roughly $100 million from US law firms in the last six months. When remote hacking didn’t yield enough leverage for multimillion-dollar ransoms, they tried something brazen: hiring people on Telegram for $500 to physically walk into law firms and plug in USB drives loaded with malware.
One intruder posed as IT support, called a lawyer claiming a virus was spreading, and said he needed physical access because remote fixes weren’t working. He showed up the next day, checked in at reception, and ran when the lawyer approached the front desk.
In another case, a man entered a law firm speaking Russian into smart glasses — likely streaming video to the cybercriminals. A second member of the group called the target lawyer’s cell phone posing as FedEx to lure him away from his desk. The intruder plugged in the USB drive.
The law firm’s defenses blocked the attack.
Why USB Delivery Still Requires a File Write
Physical access bypasses a lot of security controls. An intruder with a USB drive doesn’t need to get past your firewall, your email filters, or your web proxy. But there’s one thing they can’t bypass: the Windows file system.
When that USB drive gets plugged in and the payload tries to install itself, it has to write executable files to the hard drive. That write operation happens at the kernel level — the lowest layer of the Windows operating system, where a filter driver can intercept every file operation before it completes.
FileSure Defend operates at exactly that layer. It doesn’t try to recognize the malware. It simply enforces a rule: unauthorized programs cannot write executable files to this system.
The intruder plugs in the USB. The malware attempts to write itself to disk. The kernel filter driver intercepts the write operation, checks the authorization list, finds the program is not authorized, and blocks the write. The payload never lands on the file system. It never executes. Your files are never touched.
The attack is over before it starts.
A FileSure Rule That Blocks USB Malware Delivery
Here’s a specific rule configuration that would have stopped the Silent Ransom Group’s USB attacks:
- File name filter:
*.exe, *.dll, *.sys, *.bat, *.ps1, *.vbs, *.scr - Program name filter: All programs except authorized deployment tools and system processes
- Operations: Write, Create
- Drive type: Removable drives, Hard drives
- Result: Authorized IT tools can still write files. Everything else — including malware delivered via USB — is blocked.
You can configure this rule to log the blocked attempt and alert your security team in real time. You’ll know exactly when someone tried to install something unauthorized, from which machine, and what file they attempted to write.
The Silent Ransom Group is targeting every major law firm in the US, according to a cybersecurity executive who has facilitated ransom payments to the group. They’re willing to hire people to walk into buildings because the payoff is worth the risk.
But they still can’t bypass the kernel. A file write operation either completes or it doesn’t — and if the program writing it isn’t on your authorized list, it doesn’t.
Start a free 21-day trial of FileSure Defend at bystorm.com and test it yourself. Download our harmless test file that mimics ransomware behavior. Watch FileSure block the write operation in real time. Then try opening a Word document and watch that get logged. It works exactly like that, every time.
Category: Ransomware
Tags: silent ransom group, usb malware delivery, kernel filter driver, physical intrusion, law firm security, file system security, ransomware prevention
