1) LinkedIn - Reach to 2nd degree connections, alumni etc.
2) HR - Speak to HR at the offices you're interested in
Some general rules:
1) Never ask for a referral upfront - it's rude. If they were interested, they might not be anymore. If they weren't, well now they definitely aren't. You let them offer, and you let them know you're interested in applying. That's it
2) Play tag - If you can hopscotch across people, that's the best way to land on a good conenction (don't be annoying about it though). What I mean is, if an alumni at x office agrees to speak to him, but you're fundamentally interested y office, let him or her know at the end of the call, and ask if they know anyone you could speak to to better understand that office. Same goes for other industries!
Steps to Networking
a) Reach out to people in your network
b) Reach out to people once removed from your network
c) Reach out to people with a similar backgorund to you (i.e. same alma mater, same historically underrepresented demographic i.e. gender, orientation, ethnicity, etc., same career switch, etc.)
d) Tailor a message to them specifically both showing interest in them and their journey and demonstrating that you have done your research and could be a valuable hire
e) Play "tag" across calls you get so that you can work your way towards the company/office/role you want
f) Never directly ask for a referral, but "hint" at needing one (this is nuanced and important...happy to talk through wording)
Some great Q&As already here: