eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
FBI Advisory Warning of Social Engineering Attacks Targeting US Law Firms
Bottom Line: The FBI has issued an advisory warning that Silent Ransom Group (SRG) is actively targeting US law firms through IT support impersonation via phone, email, and physical on-site visits.
On May 26th, 2026, the FBI released an advisory warning that the Silent Ransom Group (SRG) has been persistently targeting US-based law firms with social engineering attacks, with the goal of exfiltrating sensitive data for extortion purposes. SRG, also tracked as Luna Moth, Chatty Spider, and UNC3753, is a financially motivated data extortion group. Operating since at least 2022, following the shutdown of the Conti Ransomware-as-a-Service (RaaS) operation, the group has impacted law-firms, insurance, finance, and healthcare organizations.
In the recent campaign targeting US law-firms, SRG follows a standardized playbook, in which initial contact with a potential victim is made via a direct phone call or phishing email. The actor poses as IT support staff and pressures the target into opening a remote desktop session or contacting a provided phone number. In the second phase of the attack, the user downloads a Remote Monitoring and Management (RMM) tool, such as Zoho Assist, Quick Assist, AnyDesk, RustDesk, Syncro, Splashtop, or Atera. This provides SRG direct access to the device. From there, the threat actors use tools such as WinSCP and Rclone to exfiltrate data to legitimate Cloud storage services. Notably, if remote access fails, SRG dispatches a physical operative to the victim’s location, posing as an IT technician. The individual then uses a physical USB to exfiltrate data. Lastly, SRG threatens to sell or release the stolen information, if an extortion demand is not met.
eSentire Threat Intelligence Analysis:
The introduction of physical access as an intrusion fallback marks a meaningful escalation in SRG’s operational posture. This tactic has not been reported on or widely used by other extortion groups. Dispatching a human operative to a target location requires investment, planning, and a willingness to accept greater operational risk, indicating that SRG views law firms as sufficiently high-value targets to justify these costs. The FBI does not indicate how physical assets are recruited, but it is unlikely they are informed members of SRG. If the human intrusions prove successful, it is possible that other financially motivated groups will adopt the tactic. This campaign highlights the importance of ensuring that physical access restrictions are in place, to prevent unauthorized individuals from entering secure locations.
SRG’s toolset, featuring RMM software, cloud storage platforms, and legitimate file transfer utilities, is deliberately chosen to minimize forensic artifacts and blend into normal IT operations. The FBI noted that recent SRG campaigns left few artifacts on compromised machines, meaning many incidents may go undetected until a ransom demand email arrives. It should be noted that the FBI recommends against paying ransom or extortion demands, as payments directly fund criminal groups and do not guarantee the deletion of stolen data.
In early 2026, the eSentire Threat Intelligence team has observed a significant increase in IT support impersonation attacks leading to the deployment of RMM tools; high volumes of this activity have continued through May 2026. This activity, including eSentire response actions and recommendations for defending against related attacks, are included in the Increase in Email Bombing and IT Impersonation Campaigns advisory.
Iran-Linked Threat Actor Conducting Destructive Attacks
Bottom Line: The Iranian state-linked threat group Ababil of Minab, operating under a hacktivist persona, has conducted destructive cyberattacks against US transportation authorities and Middle Eastern organizations.
On May 26th, 2026, Gambit Security published a report detailing a series of attacks perpetrated by Ababil of Minab, a threat actor group linked to Iran. The attacks that were performed involved data exfiltration and destruction, targeting organizations within the United States and the Middle East. Ababil of Minab has claimed to be a pro-Iranian hacktivist group, but further investigation into the infrastructure used by the group within their attacks has linked them to the Iranian APT Black Shadow and Iran’s Ministry of Intelligence and Security (MOIS).
Ababil of Minab claimed responsibility for a series of attacks targeting the Los Angeles County Metropolitan Transportation Authority (LACMTA / LA Metro), South Florida Regional Transportation Authority (SFRTA), United Maintenance and Contracting Company (UNIMAC), and Vyncs. The attacks involved virtual machine deletion via vCenter, partition and volume wiping via Disk Management, scripted SQL Server database deletion, and backup chain deletion via Veeam Backup and Replication. Additional attacks that were linked to Ababil of Minab involved data exfiltration, but not destruction, targeted Israeli organizations in the media and higher education industries, a Turkish insurance broker, and “several additional websites across the restaurant, culture, digital services, and news sectors”.
eSentire Threat Intelligence Analysis:
The Ababil of Minab threat group follows a pattern that has been associated with cyber threat actors linked to Iran, in that the group operates under a hacktivist persona to conduct destructive operations. These Tactics, Techniques, and Procedures (TTPs) were also seen with Handala, a group also linked to Iran’s MOIS, who conducted a destructive attack against Stryker in March 2026. Other examples of these attack patterns include the hacktivist groups Moses Staff and Abraham's Ax, which have been linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). Iran’s consistent use of fabricated hacktivist personas to conduct state-directed destructive operations represents a deliberate deniability strategy that complicates attribution and policy response.
The identified attacks against the LA Metro and SFRTA in the United States and UNIMAC in Saudi Arabia demonstrate the groups deliberate targeting of critical infrastructure against adversaries of Iran, with objectives going beyond disruption. Cyber operations have become “an integral part” of kinetic conflicts, which allow for the collection of intelligence, pressure political leadership, intimidate civilians, and shape how events are interpreted by global audiences. The cyber attacks conducted by Ababil of Minab, and similar self-claimed hacktivist groups, could likely be considered low-cost, deniable retaliation in response to the ongoing conflict in the Middle East. eSentire’s Threat Intelligence team assesses with high confidence that pro-Iranian groups will continue to perform similar destructive attacks against organizations in the United States and Middle East.
Although no specific initial access vectors are shared within the report, to protect against these threats, organizations should ensure that strong passwords, Multi-Factor Authentication (MFA), and Conditional Access policies are enforced on all accounts. Externally facing assets should be fully up to date on security patches, and external access to these devices should be restricted to trusted IP addresses, where possible. In March 2026, eSentire published an advisory, highlighting the likelihood of increased cyber attacks by Iran-linked threat actors following United States and Israeli military operations against Iran.
2026 FIFA World Cup Threat Landscape
Bottom Line: Opportunistic threat actors leverage timely and popular themes and topics to attract a large pool of victims. The FIFA World Cup presents a prime opportunity, especially for phishing campaigns.
On May 28th, 2026, Group-IB published research identifying six distinct fraud schemes and four independent threat actors operating simultaneously against the 2026 FIFA World Cup’s global audience, with over 2,500 FIFA account credential pairs already circulating in dark-web markets. Flare Research and Unit 42 published complementary assessments the same week, together painting a broad operational picture of criminal activity accelerating into the June 11th tournament opening.
The 2026 FIFA World Cup is expected to be the largest football tournament in history, with matches hosted across the United States, Canada, and Mexico. Group-IB’s investigation revealed that threat actors have registered more than 4,300 fraudulent domains impersonating FIFA’s official web presence, with over 300 domains actively hosting malicious infrastructure. The primary threat actor identified in this campaign is GHOST STADIUM, a financially motivated group believed to be of Chinese-speaking origin. This group is conducting a sophisticated phishing campaign aimed at stealing user credentials, financial information, and Personally Identifiable Information (PII).
The GHOST STADIUM campaign utilizes a highly advanced phishing kit that closely replicates the official FIFA website. Further investigation revealed six distinct fraud schemes that are being executed simultaneously as part of the broader ecosystem. These schemes include credential phishing, fake ticket sales, counterfeit merchandise stores, fake streaming platforms, fraudulent betting sites, and infostealer-based credential harvesting.
Flare Research identified at least four distinct operator clusters, each exhibiting different domain registration patterns, hosting provider choices, and WHOIS fingerprints, all drawing on shared scam kit templates. The phishing sites impersonate the official FIFA website, replicating fake ticket purchase flows, a copycat FIFA Store, and a credential-harvesting FIFA ID login page. Domain registrations continued at pace through at least mid-April 2026.
Unit 42 published a pre-tournament threat assessment for the tournament, examining three distinct adversary categories, namely state-aligned actors, ransomware groups, and criminal fraud operators. Each adversary type presents different risks to tournament participants, host city infrastructure, and the broader attendee population. Unit 42’s assessment identifies criminal fraud at scale as highly likely, consistent with patterns observed at prior mega-events from 2016 through the Milano-Cortina 2026 Winter Games.
eSentire Threat Intelligence Analysis:
The 2026 FIFA World Cup may take place in a challenging environment characterized by geopolitical tensions, advanced threat actor capabilities, and a broad and interconnected attack surface. Historical analysis of previous international sporting events highlights the consistency of cyber threats in this domain. Incidents such as the Olympic Destroyer attack in 2018, large-scale phishing campaigns during the Tokyo Olympics, and ransomware and DDoS attacks during the Paris 2024 Games demonstrate that major events are persistent and attractive targets.
Cyber threats targeting fans represent a high-volume risk. These include phishing campaigns, fake ticket platforms, malicious mobile applications, and QR-code fraud related to transportation and event access. Attackers often exploit common lure themes such as ticket availability, cancellations, lotteries, and streaming access to deceive users. Due to the global nature of the audience and varying levels of awareness, these campaigns are expected to achieve significant success at scale. High-impact scenarios also include ransomware attacks, which could disrupt operations during peak periods, and destructive malware deployments targeting tournament infrastructure. Information operations are also likely to play a role, with state-aligned actors leveraging social media and emerging technologies such as generative artificial intelligence to spread misinformation, influence public perception, and damage reputations.
To mitigate these risks, a coordinated and multi-layered defense strategy is essential. Key recommendations include multi-layered security protocols, regular vulnerability assessments, and advanced threat detection systems. Additionally, awareness and training programs are crucial; educating staff, volunteers, and stakeholders about phishing, social engineering tactics, and other cyber threats. It is strongly advised to purchase tickets only through the official FIFA website and to avoid engaging with ticket offers found on social media or unofficial platforms. Combating disinformation by delivering accurate and timely information through official channels, as well as collaborating with social media platforms to quickly identify and eliminate false content, will enhance the integrity and security of the event.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
