UNC3753 Vishing and Physical Social Engineering Campaign

Between January and May 2026, the financially motivated threat cluster UNC3753 (also known as Luna Moth and Silent Ransom Group) targeted US-based professional, legal, and financial services organizations. The campaign is characterized by a rapid operational tempo, often completing the cycle from initial contact to data exfiltration within a single business day. The group focuses on data theft and extortion, leveraging a mix of digital social engineering and, notably, physical office intrusions.

The attack chain typically begins with benign-looking email lures followed by targeted voice phishing (vishing) calls posing as internal IT support. Actors convince targets to join screen-sharing sessions (Zoom, Teams) and install commercial Remote Monitoring and Management (RMM) utilities like AnyDesk or Zoho Assist. Once access is secured, they pivot through VDI environments to harvest sensitive documents from repositories like iManage. Data is exfiltrated via Rclone, WinSCP, or direct uploads to threat actor-controlled cloud storage. A significant escalation involves physical actors posing as technicians to exfiltrate data directly via USB media.

Legal firms are primary targets due to their concentrated repositories of high-value client data and regulatory sensitivities. The inclusion of physical intrusion tactics represents a critical shift, requiring organizations to integrate physical facility access controls into their cybersecurity posture. The group demands ransom within three days, threatening to alert clients and publish data on the LEAKEDDATA leak site if ignored.