Fake IT Workers Stealing Financial Data

Google Issues Urgent Warning: Fake IT Workers Are Targeting Financial and Legal Organizations

Google's cybersecurity divisions — Mandiant and the Google Threat Intelligence Group — issued a stark warning on June 5, 2025: sophisticated data theft extortion groups are actively impersonating IT support personnel to infiltrate professional, legal, and financial services organizations. These attacks are happening both remotely and in person, and the consequences for targeted businesses can be devastating. From stolen legal agreements to exposed financial records, the scope of damage these groups can inflict is extensive — and growing.

Understanding how these attacks unfold, who is behind them, and what organizations can do to defend themselves has never been more critical. This article breaks it all down.

How the Attacks Work: Remote and Physical Intrusions

According to the joint blog post published by Mandiant and Google Threat Intelligence Group, these extortion campaigns follow two primary attack vectors: remote social engineering and physical infiltration. Both methods are designed with one goal in mind — gaining unauthorized access to sensitive internal systems and data.

Remote Attack Campaigns

In remote campaigns, threat actors begin by sending targeted emails to employees. These emails typically reference everyday business topics such as data migrations, pending invoices, or IT system updates — subjects that seem routine and non-threatening on the surface. Once an employee engages with the email, the attacker uses that initial communication as a pretext to initiate a phone call.

During the phone call, the attacker poses convincingly as a member of the company's IT support team. They then pressure or persuade the target to start a screen-sharing session and download remote management and monitoring (RMM) utilities. Once these tools are installed, the attacker has near-complete visibility into the victim's machine — and by extension, the organization's internal network.

This technique, often categorized as vishing (voice phishing), is particularly effective because it exploits employees' trust in their own IT departments. The attacker doesn't need to break through a firewall; they simply need one person to open a door.

Physical Attack Campaigns

Perhaps even more alarming are the in-person intrusions described by Google's security researchers. In physical campaigns, operatives are sent directly to corporate offices, disguised as IT technicians. These individuals gain access to office buildings — often by exploiting weak physical security practices or by simply blending in with other service workers — and then attempt to steal data using USB storage media.

This type of attack is a sobering reminder that cybersecurity is not purely a digital concern. Physical security, visitor management protocols, and employee awareness are equally critical components of a comprehensive security posture.

What Data Are These Groups After?

Once access is gained through either method, the attackers move quickly to exfiltrate high-value information. According to the Google Threat Intelligence Group's findings, targeted data typically includes:

Proprietary legal agreements and contracts
Personally identifiable information (PII) of clients and employees
Financial records and transaction histories
Sensitive internal communications and business strategies

After the data is stolen, the attackers initiate ransom negotiations, threatening to publicly release the stolen information if their demands are not met. This tactic — known as data extortion or double extortion — is designed to maximize pressure on victims, who must choose between paying a potentially massive ransom or facing severe reputational, legal, and regulatory consequences.

The Scale of the Threat: Dozens of Organizations Targeted in Early 2025

Between January and May 2025 alone, these data theft extortion groups targeted dozens of organizations across professional services, legal, and financial sectors. The concentrated nature of these attacks within such a short window indicates that these are not opportunistic campaigns — they are coordinated, well-resourced operations with clear strategic objectives.

The FBI has also weighed in. In May 2025, the bureau reported that a specific group known as the Silent Ransom Group (SRG) has been conducting data theft and extortion operations since at least 2022. SRG has been documented posing as IT department employees to gain the confidence of victims before executing their attacks. This group represents one of the most active and persistent threats in the current threat landscape.

Why Professional, Legal, and Financial Services Are Prime Targets

It is no coincidence that these attackers are focusing their efforts on law firms, financial institutions, and professional service providers. These organizations hold some of the most sensitive data in existence — client financial records, confidential legal proceedings, merger and acquisition details, and privileged communications. A single successful breach can yield enormous leverage in ransom negotiations.

Additionally, many firms in these sectors rely on third-party IT vendors and outsourced support, making the impersonation of IT personnel a particularly believable and effective ruse. Employees accustomed to receiving calls or emails from external IT teams are less likely to question the legitimacy of such communications.

How Organizations Can Defend Against These Attacks

Given the sophistication of these campaigns, organizations need to implement layered defenses that address both the digital and human elements of the threat. Here are key steps security teams and business leaders should take immediately:

Implement strict verification protocols for any IT support requests, especially those involving remote access tools or screen sharing. Require employees to verify identities through an internal directory before granting any access.
Train employees to recognize vishing attacks. Regular security awareness training should include simulated phishing and vishing exercises to build resilience against social engineering.
Restrict the use of unauthorized remote management tools. Whitelist approved RMM applications and monitor for any unauthorized installations in real time.
Strengthen physical security measures. Implement visitor badging systems, escort policies for non-employees, and surveillance in sensitive areas. USB port controls can also prevent physical data exfiltration.
Establish an incident response plan. Know exactly what steps to take if a breach is suspected, including who to contact, how to isolate affected systems, and when to engage law enforcement.
Monitor for data exfiltration signals. Use data loss prevention (DLP) tools and endpoint detection and response (EDR) platforms to catch unusual data movement before it becomes a full breach.

The Bigger Picture: A Shift in Cybercriminal Tactics

The tactics described in Google's warning reflect a broader shift in the cybercriminal ecosystem. Rather than deploying ransomware that encrypts systems and demands payment for decryption keys, many groups are now moving to pure data theft and extortion models. These approaches can be equally lucrative while being harder to detect and easier to execute — especially when combined with social engineering.

Google's decision to publish this warning publicly is itself significant. It reflects the urgency of the threat and Mandiant's commitment to keeping the broader business community informed. As these groups grow more sophisticated and their targets more varied, timely intelligence sharing becomes a critical line of defense.

Final Thoughts

The warning from Google, Mandiant, and the Google Threat Intelligence Group is a clear signal that no organization — regardless of size or sector — can afford to be complacent about cybersecurity. Fake IT workers are no longer just a plot device in a thriller novel; they are a documented, active threat operating in offices and inboxes right now.

Organizations in the legal, financial, and professional services sectors must take this warning seriously, audit their current security practices, and invest in both technical controls and human awareness. The cost of prevention is always far lower than the cost of a breach — and in today's extortion-driven threat landscape, the stakes have never been higher.