Most of the threats we write about arrive digitally: a phishing email, a spoofed link, a fake request. But some attackers have dusted off an older playbook. They put on a collared shirt, clip on a lanyard, and walk straight through the front door.
A pleasant person arrives midmorning saying they are there for the IT upgrade the office manager approved, and they know your IT provider by name. They ask you to log in so they can “run a quick check,” plug a USB drive into your computer, and make small talk while it works. A few minutes later they thank you and leave. Nothing breaks, nothing pops up, and no one thinks about it again.
Security researchers recently documented ransomware groups returning to these methods. A group researchers track as Silent Ransom Group has been calling and emailing targets while posing as IT support, even showing up on site pretending to be a technician. Once they sit down at a computer, they plug in a USB drive and copy sensitive data straight off the machine. A suspicious stranger crouched over a keyboard sets off alarm bells. A polite technician with a badge, armed with details about you, does not. We are wired to trust someone who looks like they belong and seems to be there to help. That’s what makes the tactic effective: the attacker doesn’t need to defeat your security controls if they can convince someone to give them access.
The good news is that Network 1 schedules every on-site visit in advance and sends engineers you likely know, which means you will know when we’re coming and why. We do not dispatch anonymous technicians who show up unannounced and ask to plug something into your network. Pause to confirm, and a real engineer from us won’t blink. If you can’t confirm someone is legitimate, don’t let them proceed, no matter how convincing they seem.
What to do when someone shows up unannounced:
- Verify before allowing access. If a visitor claims to be from IT, call Network 1 Consulting on the number you already have, not a number the visitor provides, and confirm the visit before they touch anything.
- Treat unannounced visits as suspect. We schedule legitimate onsite work ahead of time. A surprise technician is reason enough to say, “Let me check on that first.”
- Report it. If someone leaves after you push back, or something simply felt off, let us know. Stopping an attempt still counts as catching one, and a quick heads-up lets us investigate and warn others, if needed.
The oldest trick in the book works because it targets people, not firewalls. The fix is not more technology; it’s cultivating the habit of verifying who is standing in front of you. When in doubt, slow down and confirm. We would far rather field a call about a real engineer than one about a data breach after the fact.
Have questions about how your team should handle suspicious emails, calls, or visitors? Email [email protected].
