UNC3753 - Privnote Command Delivery

Georg Lauenstein@gsec

•updated Jun 17, 2026•0•0•20

Detects network connections to privnote.com used by UNC3753 for delivering installation commands during social engineering attacks. The threat actors use this self-destructing text service to transmit cURL commands and RMM installer links without leaving permanent browser footprints.