UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign
Summary: Google Mandiant and GTIG attributed a data theft extortion campaign against dozens of U.S. professional, legal, and financial services organizations between January and May 2026 to UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group. The group uses invoice-themed emails with no links or attachments to set a pretext, then places vishing calls posing as IT support to get victims onto screen-sharing sessions and install legitimate RMM tools such as AnyDesk, Bomgar, SuperOps RMM, or Zoho Assist, with some incidents involving attackers posing as IT technicians in person to exfiltrate data to USB or external drives.
Bottom line: Google reports the end-to-end operation from initial contact to extortion demand has occurred within a single business day, with data searches, staging, and theft completed in under an hour and the demand sent typically within 30 minutes of exiting the environment. The group targets legal firms specifically because they hold concentrated client transaction files and face reputational and regulatory exposure that may push them to settle quietly.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026