# UNC3753 (Silent Ransom Group / Luna Moth) Escalation — Physical Office Intrusion & USB Data Exfiltration Against US Legal & Financial Services (FBI Flash CSA, 2026)

> Mandiant and the FBI attribute a financially-motivated data-theft extortion campaign (Jan-May 2026) to UNC3753 (aka Luna Moth, Chatty Spider, Silent Ransom Group) targeting US legal and financial services. In a marked escalation from remote IT-support vishing, operatives now physically enter victim offices posing as IT technicians and exfiltrate privileged data to attacker-supplied USB/external drives. The full intrusion-to-extortion sequence frequently completes within a single business day, sometimes staging data in under an hour.

- **Published:** 2026-06-07T00:00:00Z
- **Last reviewed:** 2026-06-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0707
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-silent-ransom-group-usb-theft-tl-2026-0707.webp?v=79d960bb (Threadlinqs threat intel: Silent Ransom Group Physical Intrusion: Detection & IOCs (TL-2026-0707) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-0707
- **Severity:** HIGH
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** UNC3753 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

UNC3753 — tracked publicly as Silent Ransom Group (SRG), Luna Moth, and Chatty Spider — is a financially-motivated, Russia-linked extortion cluster active since at least March 2022 with tradecraft overlapping the UNC2686 BazarCall operations of 2021. Originally a ransomware affiliate deploying LOCKBIT.BLACK in 2022, the group pivoted to pure data-theft extortion and, in March 2025, shifted its lure from subscription/invoice billing themes to internal IT-helpdesk impersonation. Throughout the first half of 2026 the group has aggressively targeted US law firms and financial-services organizations, with public leaks affecting Orrick Herrington & Sutcliffe (January 2026), Jones Day, and Wood Smith Henning & Berman (Q1 2026), and a claimed breach of Ropers Majeski on 6 May 2026.

The campaign's defining 2026 escalation, the subject of an FBI TLP:CLEAR Flash advisory (26 May 2026) and a Google Cloud / Mandiant report (4 June 2026), is the addition of a PHYSICAL intrusion vector. When remote social engineering fails, SRG dispatches an operative in person to the victim's office. Posing as an IT technician performing a 'device imaging' or 'backup' in response to an earlier (benign) phishing email, the operative inserts an attacker-supplied USB drive or external hard disk directly into a victim workstation and copies privileged data offline — entirely bypassing network-based DLP and egress controls.

The remote kill chain remains active in parallel. Initial access begins with a deliberately benign invoice-themed email (no attachments or links) used to pretext a follow-up phone call (vishing). Actors impersonate internal IT/security staff, harvesting target personnel from public firm websites, and direct victims into Zoom, Microsoft Teams, Microsoft Terminal Services, or Quick Assist screen-sharing sessions. From there they install RMM tooling — AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM — frequently delivered via Privnote self-destructing links and silent MSI installation (e.g. curl download piped to msiexec /quiet). Operators enumerate local directories, OneDrive, and mapped network shares, then perform keyword searches against iManage document-management repositories to locate tax records (W-2/W-9/1099), SSNs, audit files, and client legal agreements. Staged data is exfiltrated via WinSCP (portable), Rclone (hidden/renamed), FTP/SFTP, direct browser uploads to actor-controlled Google Drive accounts, or victim-initiated email forwarding to actor mailboxes. In one documented incident the actor moved 1.7 GB to Google Drive before pivoting to WinSCP to extract an additional 14.4 GB after Google disabled the account.

Extortion follows within ~30 minutes of the operator leaving the environment. Demands carry a strict three-day negotiation window and threaten employee/client notification, regulatory-fine and litigation pressure, and publication on the group's LEAKEDDATA / business-data-leaks[.]com data-leak site. The physical-intrusion TTP warrants detection logic — removable-media DLP, USB-write/insider endpoint monitoring, and front-desk technician verification — not covered by prior remote-callback threat tracking (related: TL-2026-0612).

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Acquire Infrastructure: Domains
- T1566.004 Phishing: Spearphishing Voice
- T1566 Phishing
- T1200 Hardware Additions
- T1133 External Remote Services
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1569.002 System Services: Service Execution
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1219 Remote Access Tools
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.004 Remote Services: SSH
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1530 Data from Cloud Storage
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SRG/UNC3753 Silent RMM Install via msiexec /quiet Following Curl Staging — Exploitation Phase** (`TL-2026-0707-SPL-001`)

Detects the UNC3753/Silent Ransom Group initial-access execution chain: a curl.exe or certutil.exe download of an installer to a temp path immediately followed by silent MSI installation (msiexec /i ... /quiet) of an RMM agent (SuperOps, AnyDesk, Bomgar, Zoho Assist). This is the post-vishing/screen-share install step used to gain persistent remote access.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1219, T1059.001, T1204.002
- **Data sources:** sysmon, windows_security, edr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\msiexec.exe" OR Image="*\\curl.exe" OR Image="*\\certutil.exe")
| eval is_silent_msi=if((Image="*\\msiexec.exe" AND match(CommandLine,"(?i)/quiet|/qn") AND match(CommandLine,"(?i)/i")),1,0)
| eval is_rmm=if(match(CommandLine,"(?i)SuperOps|AnyDesk|ZohoAssist|Zoho.?Assist|bomgar|\.msi"),1,0)
| eval is_download=if((Image="*\\curl.exe" OR Image="*\\certutil.exe") AND match(CommandLine,"(?i)http|-urlcache|-o "),1,0)
| where is_silent_msi=1 OR is_download=1
| stats values(CommandLine) as commandlines values(Image) as images min(_time) as first_seen max(_time) as last_seen dc(Image) as distinct_procs by host, ParentImage, User
| where distinct_procs>=1
| eval window_secs=last_seen-first_seen
| table host, User, ParentImage, images, commandlines, window_secs, first_seen, last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('msiexec.exe','curl.exe','certutil.exe')
| extend SilentMsi = (FileName =~ 'msiexec.exe' and ProcessCommandLine has_any ('/quiet','/qn') and ProcessCommandLine has '/i')
| extend RmmRef = ProcessCommandLine has_any ('SuperOps','AnyDesk','ZohoAssist','Zoho Assist','bomgar')
| extend Downloader = (FileName in~ ('curl.exe','certutil.exe') and ProcessCommandLine has_any ('http','-urlcache','-o'))
| where SilentMsi or Downloader
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SilentMsi, RmmRef, Downloader
| order by Timestamp asc
```

### Sigma

```yaml
title: SRG/UNC3753 Silent RMM Install via msiexec Quiet Flag with Curl Staging
id: 7c1f0a3e-2b44-4d9a-9f1c-0707a1b2c3d1
status: experimental
description: Detects silent RMM MSI installation (msiexec /i /quiet) and curl/certutil installer downloads used by Silent Ransom Group (UNC3753) to gain remote access after vishing.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms
    - https://www.ic3.gov/CSA/2026/260526.pdf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/07
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
    - attack.tool.anydesk
logsource:
    product: windows
    category: process_creation
detection:
    silent_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains|all:
            - '/i'
        CommandLine|contains:
            - '/quiet'
            - '/qn'
    rmm_ref:
        CommandLine|contains:
            - 'SuperOps'
            - 'AnyDesk'
            - 'ZohoAssist'
            - 'bomgar'
    downloader:
        Image|endswith:
            - '\curl.exe'
            - '\certutil.exe'
        CommandLine|contains:
            - 'http'
            - '-urlcache'
    condition: (silent_msi and rmm_ref) or downloader
falsepositives:
    - Legitimate IT software deployment via msiexec silent install
    - Sanctioned RMM rollout by internal IT
level: high
```

**Known false positives:**

- Legitimate IT software deployment via msiexec silent install
- Sanctioned RMM rollout by internal IT teams
- Curl/certutil used in legitimate admin scripts

**Tuning notes:** Allow-list approved RMM agents and known IT deployment service accounts/hosts. Tighten by correlating with a preceding screen-share process (QuickAssist.exe, Zoom, Teams) within a short window to reduce benign admin noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SRG/UNC3753 Silent RMM Install Chain on Defender Endpoints — Exploitation Phase (locked: unlock with TL Creds)
- SRG/UNC3753 Run-Key Persistence and Rapid Tax/PII Document Discovery — Post-Exploitation Phase (locked: unlock with TL Creds)
- SRG/UNC3753 Removable-Media and Rclone/WinSCP Exfiltration on Defender Endpoints — Exfiltration Phase (locked: unlock with TL Creds)
- SRG/UNC3753 Silent RMM Install via msiexec Quiet Flag — Exploitation Phase (Sigma) (locked: unlock with TL Creds)
- SRG/UNC3753 USB Mass-Storage Write of Office Documents — Post-Exploitation/Collection Phase (Sigma) (locked: unlock with TL Creds)
- SRG/UNC3753 Rclone/WinSCP Cloud and SFTP Bulk Exfiltration with Actor C2 Contact — C2/Exfiltration Phase (Sigma) (locked: unlock with TL Creds)
- SRG/UNC3753 RMM Run-Key Persistence with iManage Sensitive-Doc Discovery — Post-Exploitation Phase (locked: unlock with TL Creds)
- SRG/UNC3753 USB Removable-Media and Rclone/WinSCP Cloud-SFTP Bulk Exfiltration — Exfiltration/C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `192.236.147[.]131`
- Domain: `business-data-leaks[.]com`
- IP address: `192.236.147[.]138`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ongoing Targeted Campaign Against US Law Firms (UNC3753)](https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms)
- [FBI Flash: Silent Ransom Group Impersonating IT Personnel through Social Engineering](https://www.ic3.gov/CSA/2026/260526.pdf)
- [FBI warns of Silent Ransom Group in-person data theft attacks](https://www.bleepingcomputer.com/news/security/fbi-warns-of-silent-ransom-group-in-person-data-theft-attacks/)
- [UNC3753 Targets US Law Firms with Vishing, RMM Tools, and Physical Break-Ins](https://gbhackers.com/unc3753-targets-us-law-firms/)
- [Silent Ransom Group Sends Operatives Into Law Firm Offices: 38 Firms Already Leaked](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm)
- [FBI Flash Report TLP:Clear: Silent Ransom Group Impersonating IT Personnel (AHA)](https://www.aha.org/cybersecurity-government-intelligence-reports/2026-05-26-fbi-flash-report-tlp-clear-silent-ransom-group-impersonating-it)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0707