UNC3753 (Silent Ransom Group / Luna Moth) Escalation — Physical Office Intrusion & USB Data Exfiltration Against US Legal & Financial Services (FBI Flash CSA, 2026)

Key facts for Silent Ransom Group USB theft

Detection coverage for Silent Ransom Group USB theft

As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0707 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SRG/UNC3753 Silent RMM Install via msiexec /quiet Following Curl Staging — Exploitation Phase

Detects the UNC3753/Silent Ransom Group initial-access execution chain: a curl.exe or certutil.exe download of an installer to a temp path immediately followed by silent MSI installation (msiexec /i ... /quiet) of an RMM agent (SuperOps, AnyDesk, Bomgar, Zoho Assist). This is the post-vishing/screen-share install step used to gain persistent remote access.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1219, T1059.001, T1204.002
• Data sources: sysmon, windows_security, edr
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\msiexec.exe" OR Image="*\\curl.exe" OR Image="*\\certutil.exe")
| eval is_silent_msi=if((Image="*\\msiexec.exe" AND match(CommandLine,"(?i)/quiet|/qn") AND match(CommandLine,"(?i)/i")),1,0)
| eval is_rmm=if(match(CommandLine,"(?i)SuperOps|AnyDesk|ZohoAssist|Zoho.?Assist|bomgar|\.msi"),1,0)
| eval is_download=if((Image="*\\curl.exe" OR Image="*\\certutil.exe") AND match(CommandLine,"(?i)http|-urlcache|-o "),1,0)
| where is_silent_msi=1 OR is_download=1
| stats values(CommandLine) as commandlines values(Image) as images min(_time) as first_seen max(_time) as last_seen dc(Image) as distinct_procs by host, ParentImage, User
| where distinct_procs>=1
| eval window_secs=last_seen-first_seen
| table host, User, ParentImage, images, commandlines, window_secs, first_seen, last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('msiexec.exe','curl.exe','certutil.exe')
| extend SilentMsi = (FileName =~ 'msiexec.exe' and ProcessCommandLine has_any ('/quiet','/qn') and ProcessCommandLine has '/i')
| extend RmmRef = ProcessCommandLine has_any ('SuperOps','AnyDesk','ZohoAssist','Zoho Assist','bomgar')
| extend Downloader = (FileName in~ ('curl.exe','certutil.exe') and ProcessCommandLine has_any ('http','-urlcache','-o'))
| where SilentMsi or Downloader
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SilentMsi, RmmRef, Downloader
| order by Timestamp asc

Sigma

title: SRG/UNC3753 Silent RMM Install via msiexec Quiet Flag with Curl Staging
id: 7c1f0a3e-2b44-4d9a-9f1c-0707a1b2c3d1
status: experimental
description: Detects silent RMM MSI installation (msiexec /i /quiet) and curl/certutil installer downloads used by Silent Ransom Group (UNC3753) to gain remote access after vishing.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms
    - https://www.ic3.gov/CSA/2026/260526.pdf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/07
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
    - attack.tool.anydesk
logsource:
    product: windows
    category: process_creation
detection:
    silent_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains|all:
            - '/i'
        CommandLine|contains:
            - '/quiet'
            - '/qn'
    rmm_ref:
        CommandLine|contains:
            - 'SuperOps'
            - 'AnyDesk'
            - 'ZohoAssist'
            - 'bomgar'
    downloader:
        Image|endswith:
            - '\curl.exe'
            - '\certutil.exe'
        CommandLine|contains:
            - 'http'
            - '-urlcache'
    condition: (silent_msi and rmm_ref) or downloader
falsepositives:
    - Legitimate IT software deployment via msiexec silent install
    - Sanctioned RMM rollout by internal IT
level: high

Known false positives:

• Legitimate IT software deployment via msiexec silent install
• Sanctioned RMM rollout by internal IT teams
• Curl/certutil used in legitimate admin scripts

Tuning notes: Allow-list approved RMM agents and known IT deployment service accounts/hosts. Tighten by correlating with a preceding screen-share process (QuickAssist.exe, Zoom, Teams) within a short window to reduce benign admin noise.

• 🔒 SRG/UNC3753 Silent RMM Install Chain on Defender Endpoints — Exploitation Phase · unlock with TL Creds
• 🔒 SRG/UNC3753 Run-Key Persistence and Rapid Tax/PII Document Discovery — Post-Exploitation Phase · unlock with TL Creds
• 🔒 SRG/UNC3753 Removable-Media and Rclone/WinSCP Exfiltration on Defender Endpoints — Exfiltration Phase · unlock with TL Creds
• 🔒 SRG/UNC3753 Silent RMM Install via msiexec Quiet Flag — Exploitation Phase (Sigma) · unlock with TL Creds
• 🔒 SRG/UNC3753 USB Mass-Storage Write of Office Documents — Post-Exploitation/Collection Phase (Sigma) · unlock with TL Creds
• 🔒 SRG/UNC3753 Rclone/WinSCP Cloud and SFTP Bulk Exfiltration with Actor C2 Contact — C2/Exfiltration Phase (Sigma) · unlock with TL Creds
• 🔒 SRG/UNC3753 RMM Run-Key Persistence with iManage Sensitive-Doc Discovery — Post-Exploitation Phase · unlock with TL Creds
• 🔒 SRG/UNC3753 USB Removable-Media and Rclone/WinSCP Cloud-SFTP Bulk Exfiltration — Exfiltration/C2 Phase · unlock with TL Creds

Indicators of compromise for Silent Ransom Group USB theft

As of 2026-06-07, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-0707.

Sample indicators (3 of 21)

• IP address: 192.236.147[.]131
• Domain: business-data-leaks[.]com
• IP address: 192.236.147[.]138

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

How Silent Ransom Group USB theft works

The full intrusion-to-extortion sequence frequently completes within a single business day, sometimes staging data in under an hour.

UNC3753 — tracked publicly as Silent Ransom Group (SRG), Luna Moth, and Chatty Spider — is a financially-motivated, Russia-linked extortion cluster active since at least March 2022 with tradecraft overlapping the UNC2686 BazarCall operations of 2021. Originally a ransomware affiliate deploying LOCKBIT.BLACK in 2022, the group pivoted to pure data-theft extortion and, in March 2025, shifted its lure from subscription/invoice billing themes to internal IT-helpdesk impersonation. Throughout the first half of 2026 the group has aggressively targeted US law firms and financial-services organizations, with public leaks affecting Orrick Herrington & Sutcliffe (January 2026), Jones Day, and Wood Smith Henning & Berman (Q1 2026), and a claimed breach of Ropers Majeski on 6 May 2026.

The campaign's defining 2026 escalation, the subject of an FBI TLP:CLEAR Flash advisory (26 May 2026) and a Google Cloud / Mandiant report (4 June 2026), is the addition of a PHYSICAL intrusion vector. When remote social engineering fails, SRG dispatches an operative in person to the victim's office. Posing as an IT technician performing a 'device imaging' or 'backup' in response to an earlier (benign) phishing email, the operative inserts an attacker-supplied USB drive or external hard disk directly into a victim workstation and copies privileged data offline — entirely bypassing network-based DLP and egress controls.

The remote kill chain remains active in parallel. Initial access begins with a deliberately benign invoice-themed email (no attachments or links) used to pretext a follow-up phone call (vishing). Actors impersonate internal IT/security staff, harvesting target personnel from public firm websites, and direct victims into Zoom, Microsoft Teams, Microsoft Terminal Services, or Quick Assist screen-sharing sessions. From there they install RMM tooling — AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM — frequently delivered via Privnote self-destructing links and silent MSI installation (e.g. curl download piped to msiexec /quiet). Operators enumerate local directories, OneDrive, and mapped network shares, then perform keyword searches against iManage document-management repositories to locate tax records (W-2/W-9/1099), SSNs, audit files, and client legal agreements. Staged data is exfiltrated via WinSCP (portable), Rclone (hidden/renamed), FTP/SFTP, direct browser uploads to actor-controlled Google Drive accounts, or victim-initiated email forwarding to actor mailboxes. In one documented incident the actor moved 1.7 GB to Google Drive before pivoting to WinSCP to extract an additional 14.4 GB after Google disabled the account.

Extortion follows within ~30 minutes of the operator leaving the environment. Demands carry a strict three-day negotiation window and threaten employee/client notification, regulatory-fine and litigation pressure, and publication on the group's LEAKEDDATA / business-data-leaks[.]com data-leak site. The physical-intrusion TTP warrants detection logic — removable-media DLP, USB-write/insider endpoint monitoring, and front-desk technician verification — not covered by prior remote-callback threat tracking (related: TL-2026-0612).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1039 Data from Network Shared Drive; T1530 Data from Cloud Storage

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.004 Remote Services: SSH

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File; T1569.002 System Services: Service Execution

Discovery

T1083 File and Directory Discovery; T1135 Network Share Discovery

Initial Access

T1133 External Remote Services; T1200 Hardware Additions; T1566 Phishing; T1566.004 Phishing: Spearphishing Voice

Command and Control

T1219 Remote Access Tools

Resource Development

T1583.001 Acquire Infrastructure: Domains

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Remediation for Silent Ransom Group USB theft

Immediate actions

• Enforce out-of-band identity verification for any on-site or remote IT technician before granting workstation access; require pre-scheduled work orders and photo-ID logging by front-desk staff
• Disable USB mass-storage read/write via GPO/MDM and block removable-media device installation on endpoints holding privileged data
• Block installation and execution of unsanctioned RMM tools (AnyDesk, Bomgar, Zoho Assist, SuperOps) via application control (WDAC/EDR)
• Block the known C2/exfil IPs and typosquat helpdesk domains at the perimeter; alert on connections to privnote.com and business-data-leaks.com

Workarounds

• Restrict interactive screen-control features in Microsoft Teams, Zoom, and Quick Assist
• Monitor outbound SSH/port-22 and FTP for high-volume WinSCP/Rclone transfers with byte-count session logging

Longer-term hardening

• Deploy removable-media DLP with content inspection and USB-write alerting
• Restrict VDI/VPN authentication to corporate-owned, compliant devices with MFA step-up; block BYOD pivots into corporate VDI
• Implement iManage/SharePoint anomaly alerting for rapid keyword searches and mass downloads, with MFA on document repositories
• Mandatory escort policy for all technical/visitor personnel; conduct vishing-focused security awareness training

Affected and fixed versions

• US Legal Services — Law Firms (iManage document repositories)
  Vulnerable versions: all
• US Financial Services — Accounting / Financial Advisory Firms
  Vulnerable versions: all

Timeline of Silent Ransom Group USB theft

• 2022-03-01 UNC3753 (Luna Moth / Silent Ransom Group) first observed; tradecraft overlaps UNC2686 BazarCall operations (2021).
• 2022-06-01 Group operated as a ransomware affiliate deploying LOCKBIT.BLACK before pivoting to data-theft-only extortion.
• 2023-01-01 Sustained targeting of US legal and financial-services organizations begins.
• 2025-03-01 Actors shift lures from subscription/invoice billing themes to internal IT-helpdesk impersonation.
• 2026-01-15 Data from Orrick, Herrington & Sutcliffe posted publicly after the firm declined the ransom demand.
• 2026-03-15 Jones Day and Wood Smith Henning & Berman suffer data exposures during Q1 2026.
• 2026-05-06 SRG claims responsibility for a breach at Ropers Majeski.
• 2026-05-26 FBI issues TLP:CLEAR Flash advisory (260526) warning of SRG IT-personnel impersonation and in-person data theft.
• 2026-05-27 Public reporting confirms physical office intrusion with USB data theft; ~38 firms already leaked.
• 2026-06-04 Google Cloud / Mandiant publishes detailed UNC3753 technical analysis including tools, IOCs, and MITRE mappings.
• 2026-06-07 Threadlinqs Intelligence documents the escalation as TL-2026-0707 with removable-media detection focus.

Sources cited for Silent Ransom Group USB theft

• FBI Flash: Silent Ransom Group Impersonating IT Personnel through Social Engineering ic3.gov · Advisory · 2026-05-26
• FBI Flash Report TLP:Clear: Silent Ransom Group Impersonating IT Personnel (AHA) aha.org · Advisory · 2026-05-26
• Ongoing Targeted Campaign Against US Law Firms (UNC3753) Google Cloud · Research · 2026-06-04
• FBI warns of Silent Ransom Group in-person data theft attacks BleepingComputer · News · 2026-05-27
• UNC3753 Targets US Law Firms with Vishing, RMM Tools, and Physical Break-Ins gbhackers.com · News · 2026-06-04
• Silent Ransom Group Sends Operatives Into Law Firm Offices: 38 Firms Already Leaked techtimes.com · News · 2026-05-27

Threats related to Silent Ransom Group USB theft

• UNC3753 (Luna Moth / Silent Ransom Group) Vishing and Physical Intrusion Campaign Against US Law Firms
• Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical Intrusion)
• Silent Ransom Group (Luna Moth / Chatty Spider / UNC3753) — IT Support Impersonation Campaign Targeting US Law Firms (FBI FLASH Advisory, May 2026)
• Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusion