UNC3753 (Luna Moth / Silent Ransom Group) Vishing and Physical Intrusion Campaign Against US Law Firms

Key facts for Luna Moth vishing physical intrusion

Detection coverage for Luna Moth vishing physical intrusion

As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2127 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vishing-Delivered RMM Silent Install via curl+msiexec (Luna Moth/UNC3753) — SPL

Detects the curl-download-then-silent-msiexec-install pattern UNC3753/Luna Moth/Silent Ransom Group operators use immediately after an IT-helpdesk-impersonation vishing call to push AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM onto a victim endpoint, optionally correlated with DNS resolution of actor-registered lookalike domains (*-itdesk.com, *-it.com, *-helpdesk.com) or privnote.com used to deliver the install link during the call.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.004, T1204.002, T1059.003, T1569.002, T1133, T1219
• Data sources: sysmon, windows_security, dns, proxy
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\curl.exe") CommandLine="*curl*" CommandLine="*-o*" CommandLine="*.msi*"
| eval stage="download"
| append [
    search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    Image="*\\msiexec.exe" CommandLine="*/quiet*"
    (CommandLine="*AnyDesk*" OR CommandLine="*Bomgar*" OR CommandLine="*ZohoAssist*" OR CommandLine="*SuperOps*")
    | eval stage="silent_install"
]
| append [
    search index=dns sourcetype="dns"
    (query="*-itdesk.com" OR query="*-it.com" OR query="*-helpdesk.com" OR query="privnote.com")
    | eval stage="lure_domain_resolution"
]
| stats earliest(_time) as first_seen latest(_time) as last_seen values(stage) as stages_seen values(CommandLine) as commands dc(stage) as stage_count by Computer, user
| where stage_count >= 2
| sort - last_seen

Microsoft KQL

let RMMKeywords = dynamic(["AnyDesk","Bomgar","ZohoAssist","SuperOps"]);
let LureDomains = dynamic(["-itdesk.com","-it.com","-helpdesk.com","privnote.com"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("curl.exe") and ProcessCommandLine has "-o" and ProcessCommandLine has ".msi")
    or (FileName =~ "msiexec.exe" and ProcessCommandLine has "/quiet" and ProcessCommandLine has_any (RMMKeywords))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (LureDomains)
    | project DeviceName, RemoteUrl, NetTimestamp = Timestamp
) on DeviceName
| summarize Events = count(), Commands = make_set(ProcessCommandLine), LureHits = make_set(RemoteUrl) by DeviceName, AccountName, bin(Timestamp, 1h)
| where Events >= 1

Sigma

title: RMM Tool Silent Install via curl-Delivered MSI (Luna Moth / UNC3753 Vishing Chain)
id: 7a1c2f3e-9b4d-4e2a-8c6f-1d3e5a7b9c01
status: experimental
description: Detects a curl download of an MSI installer followed by a silent msiexec install of a commercial RMM tool (AnyDesk, Bomgar, Zoho Assist, SuperOps RMM), the delivery pattern UNC3753/Luna Moth/Silent Ransom Group uses immediately after a vishing call impersonating IT helpdesk staff.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms/
    - https://www.ic3.gov/CSA/2026/260526.pdf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.initial-access
    - attack.t1566.004
    - attack.t1133
    - attack.execution
    - attack.t1204.002
    - attack.t1059.003
    - attack.t1569.002
    - attack.lateral-movement
    - attack.t1219
    - attack.tool.anydesk
logsource:
    category: process_creation
    product: windows
detection:
    selection_download:
        Image|endswith: '\curl.exe'
        CommandLine|contains|all:
            - '-o'
            - '.msi'
    selection_install:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: '/quiet'
        CommandLine|contains:
            - 'AnyDesk'
            - 'Bomgar'
            - 'ZohoAssist'
            - 'SuperOps'
    condition: selection_download or selection_install
falsepositives:
    - Legitimate IT-managed software deployment via SCCM/Intune using similar msiexec silent-install syntax
    - Authorized helpdesk staff performing scripted RMM installs during onboarding
level: high

Known false positives:

• Legitimate IT-managed software deployment via SCCM/Intune using similar msiexec silent-install syntax
• Authorized helpdesk staff performing scripted RMM installs during onboarding

Tuning notes: Scope the lure-domain match to your own organization's naming pattern (e.g. <orgname>-itdesk.com) rather than a static list, and maintain an allow-list of company-approved RMM binaries/hash values to suppress alerts from legitimate IT deployment tooling.

• 🔒 Vishing-Delivered RMM Silent Install via curl+msiexec (Luna Moth/UNC3753) — KQL · unlock with TL Creds
• 🔒 BYOD-to-Corporate VDI Pivot & Targeted iManage Legal-Document Search (Luna Moth/UNC3753) — KQL · unlock with TL Creds
• 🔒 WinSCP/Rclone Mass SFTP Exfiltration & USB Physical-Intrusion Data Theft (Luna Moth/UNC3753) — KQL · unlock with TL Creds
• 🔒 Vishing-Delivered RMM Silent Install via curl+msiexec (Luna Moth/UNC3753) — Sigma · unlock with TL Creds
• 🔒 BYOD-to-Corporate VDI Pivot & Targeted iManage Legal-Document Search (Luna Moth/UNC3753) — Sigma · unlock with TL Creds
• 🔒 WinSCP/Rclone Mass SFTP Exfiltration & USB Physical-Intrusion Data Theft (Luna Moth/UNC3753) — Sigma · unlock with TL Creds
• 🔒 BYOD-to-Corporate VDI Pivot & Targeted iManage Legal-Document Search (Luna Moth/UNC3753) — SPL · unlock with TL Creds
• 🔒 WinSCP/Rclone Mass SFTP Exfiltration & USB Physical-Intrusion Data Theft (Luna Moth/UNC3753) — SPL · unlock with TL Creds

Indicators of compromise for Luna Moth vishing physical intrusion

As of 2026-10-12, Threadlinqs Intelligence tracks 38 indicators of compromise for TL-2026-2127.

Sample indicators (3 of 38)

• IP address: 192.236.147[.]131
• Domain: business-data-leaks[.]com
• File hash: 598281d2c6de83adf1505ee6077608d0c043623d477e2884d36d65e90686d67a

Defanged, TLP:CLEAR. Full set of 38 indicators: unlock with TL Creds.

How Luna Moth vishing physical intrusion works

An FBI FLASH alert (FLASH-20260526-01) confirms the campaign escalated to in-person physical office intrusions when remote social engineering fails.

UNC3753 — publicly tracked as Luna Moth, Chatty Spider, and Silent Ransom Group (SRG) — is a financially motivated, Russia-nexus extortion actor active since March 2022, formed in the wake of the Conti ransomware syndicate's collapse. The group does not encrypt victim data; it steals it and extorts victims with threats of public disclosure, a tactic it has run consistently even after briefly deploying LOCKBIT.BLACK ransomware in 2022 before deprioritizing encryption entirely.

The group's initial-access tradecraft has evolved through three distinct phases. From 2022 through early 2025 it ran callback-phishing campaigns: emails impersonating well-known subscription services (in the style of the related UNC2686/'BazarCall' cluster) prompted victims to call a fraudulent support number, where an operator talked them into installing remote-access software. In March 2025 the group pivoted to direct voice phishing (vishing): operators harvest employee phone numbers from public corporate websites, call posing as internal IT helpdesk or security staff, and use pretexts such as 'resolving a security issue' or a 'corporate data migration' to talk targets into a screen-sharing session (Zoom, Microsoft Teams, Microsoft Quick Assist, or Terminal Services) and then a commercial RMM install (AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM, typically delivered via a curl/msiexec one-liner and a self-destructing privnote[.]com link). A parallel, generic 'invoice' email lure ('hello, here is the invcoie we talked about yesterday') is used to prime targets ahead of the call, without any malicious attachment or link.

Beginning around April 2025, and confirmed as an active, ongoing tactic by the FBI in a May 26, 2026 TLP:CLEAR FLASH alert (FLASH-20260526-01), the group escalated further: when remote social engineering fails, an operator physically travels to the victim's office, poses as an IT technician needing to 'image a device' or 'create a local backup,' and attempts to exfiltrate data directly onto a USB storage device.

Once inside an environment — remotely or physically — operators move with unusual speed: full lifecycle from initial contact to data theft and extortion has been observed within a single business day, with staging beginning inside the first hour. They compromise personal (BYOD) laptops via the screen-sharing session, then pivot into the corporate environment through native VDI clients (Windows365.exe, Citrix). Inside the environment they enumerate local directories, mapped network drives, and OneDrive folders, and run targeted keyword searches inside legal document-management systems (iManage) for W-2/W-9/1099 tax forms, audit files, client agreements, and Social Security numbers. Staged data is exfiltrated via drag-and-drop into actor-controlled consumer cloud storage (renamed to mimic the victim's branding), portable WinSCP, or Rclone over SFTP, or forwarded from the victim's own mailbox to actor-controlled consumer email addresses. In one documented incident, 1.7GB was pulled via OneDrive and 14.4GB via WinSCP.

Extortion follows within roughly 30 minutes of the actor exiting the environment: a letter (subject line pattern '[Victim Name] has lost confidential data of their clients. Very Important!') gives the victim a 3-day deadline, threatening direct outreach to employees and clients, publication on the group's leak site (business-data-leaks[.]com, also referenced as 'LEAKEDDATA DLS'), regulatory fines, and client lawsuits. Reported ransom demands range from roughly $1 million to as much as $20 million per victim. Public reporting attributes at least 38 law firms with data already posted to the leak site and estimates more than 100 total attacks in the campaign window, with named victims including Orrick, Herrington & Sutcliffe (data posted January 2026 after declining to pay), Jones Day, Wood Smith Henning & Berman (Q1 2026), and Ropers Majeski (claimed May 6, 2026).

Targeting is concentrated on US-based professional services, with a strong emphasis on law firms (for privileged, high-leverage client data) and financial/insurance services. Mandiant and the FBI jointly recommend physical-access controls (visitor ID verification against pre-scheduled work orders, mandatory escort of technical personnel), RMM/screen-sharing application control, BYOD-aware conditional access restricting VDI/VPN to corporate-owned devices with MFA step-up, USB mass-storage lockdown via GPO/MDM, and application-level auditing (real-time bulk-download and search-spike alerting) on iManage, SharePoint, and corporate email.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1003.002 OS Credential Dumping: Security Account Manager

Collection

T1005 Data from Local System; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Exfiltration

T1020 Automated Exfiltration; T1048 Exfiltration Over Alternative Protocol; T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.004 Remote Services

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070.001 Indicator Removal: Clear Windows Event Logs; T1656 Impersonation

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File; T1569.002 System Services: Service Execution

Discovery

T1083 File and Directory Discovery; T1135 Network Share Discovery

Command and Control

T1105 Ingress Tool Transfer

Initial Access

T1133 External Remote Services; T1566.004 Phishing: Spearphishing Voice

command-and-control

T1219 Remote Access Tools

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1585.002 Establish Accounts: Email Accounts

Impact

T1657 Financial Theft

Remediation for Luna Moth vishing physical intrusion

Patches

• N/A — initial access is voice-phishing and in-person social engineering, not a software vulnerability; no vendor patch applies

Immediate actions

• Require official credentials and photo ID for any in-person IT/technician visit; verify against pre-scheduled work orders before granting building or device access
• Block unauthorized RMM and screen-sharing installers (AnyDesk, Bomgar, Zoho Assist, SuperOps RMM) via application allow-listing / Windows Defender Application Control or EDR
• Disable read/write for USB mass-storage devices via GPO/MDM on endpoints handling client data
• Restrict screen-control features in Zoom and Microsoft Teams to prevent unsolicited remote-control sessions

Workarounds

• Publish and enforce a single verified internal IT contact number; instruct staff to never accept remote-access instructions from an inbound caller claiming to be IT
• Mandate escort of all technical service personnel and log visitor IDs at reception
• Enforce MFA on iManage and other document-management repositories independent of network-level authentication
• Restrict removable and optical media on endpoints and BYOD systems that can reach VDI

Longer-term hardening

• Restrict VDI/VPN authentication to corporate-owned devices only, with MFA step-up for any BYOD-originated access attempt
• Enable full session logging with byte-transfer metrics on egress paths and monitor SSH/SFTP (port 22) from internal VDIs for WinSCP/Rclone transfer patterns
• Deploy real-time alerting for rapid file-search bursts and mass downloads inside iManage, SharePoint, and corporate email
• Run recurring vishing-specific awareness training that covers IT-helpdesk-impersonation pretexts and in-person 'technician' social engineering

Affected and fixed versions

• N/A — iManage document management deployments at US law firms
  Vulnerable versions: any deployment reachable via compromised VDI/RDP without additional MFA or bulk-access alerting
• N/A — US professional, legal, financial, and insurance services organizations
  Vulnerable versions: organizations lacking physical-visitor verification and RMM/screen-share application control

Timeline of Luna Moth vishing physical intrusion

Last updated 2026-10-12 · 3 updates · revalidated 3× · latest source

Showing the 20 most recent tracked events.

• 2025-03-01 Group shifts from subscription-themed callback-phishing lures to direct voice phishing (vishing), impersonating internal IT helpdesk staff over the phone.
• 2025-04-01 Group begins sending operators to physically enter victim offices posing as IT technicians when remote social-engineering attempts fail.
• 2025-05-23 FBI issues an earlier public-service announcement (PIN 052325) warning that Silent Ransom Group is targeting US law firms via vishing.
• 2025-08-27 Earliest messages in the leaked internal SRG chat archive (about 5,700 messages, running through late September 2026).
• 2026-01-01 locked-ioc-7 has stolen data posted to the group's leak site after declining to pay the ransom demand.
• 2026-01-01 Start of the January-May 2026 campaign window documented by Mandiant, showing dozens of US legal/financial/professional-services organizations targeted.
• 2026-04-03 Start of the alleged window of 27 law-firm ransom payments (about $206.95M claimed, unverified); Crystal Intelligence notes a six-week peak of about 344 BTC (about $27M) in April-May 2026.
• 2026-04-22 Recruiter consolidates two payouts into one on-chain transaction, linking previously segregated wallets (Crystal Intelligence; leaked-chat based, alleged).
• 2026-05-06 Silent Ransom Group publicly claims responsibility for a breach at law firm locked-ioc-19.
• 2026-05-26 FBI publishes TLP:CLEAR FLASH alert FLASH-20260526-01, formally confirming Silent Ransom Group's escalation to in-person physical office intrusions for data exfiltration.
• 2026-06-05 Mandiant/Google Threat Intelligence Group publishes 'Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms,' detailing the full TTP chain, IOCs, and MITRE ATT&CK mapping for UNC3753.
• 2026-09-02 Hogan Lovells Cadwalader reportedly offers $4M in negotiations (alleged, from leaked chats).
• 2026-09-24 End of the alleged payment window covering 27 law-firm victims.
• 2026-10-05 Anonymous onion site 'The Luna Moth Files' releases chat logs, a vishing document, screenshots and a purported fake-employee resume attributed to the group.
• 2026-10-07 'The Luna Moth Files' leaked chats reported by DataBreaches.Net; Chainalysis says certain leaked addresses sit downstream of millions of dollars in SRG ransom payments.
• 2026-10-08 The Register and The Record publish analyses; Crystal Intelligence traces about 2,675 BTC through an upstream collection wallet; the group denies the leak.
• 2026-10-09 Check Point publishes analysis of the leak describing a segmented data-extortion business (researchers, callers, technical operators, negotiators), victim labels (CHAT, OFFER, CONTRACT, GOLD), 42 of the 50 most recent victims being law firms, and the experimental 'Fake_Employee' project.
• 2026-10-09 SRG claims the 'Luna Moth Files' are fake; DataBreaches.Net publishes a rebuttal saying the data suggest otherwise.
• 2026-10-10 Security Affairs reports the alleged $207M extortion from 27 law firms without encryption.
• 2026-10-12 Infosecurity Magazine reports on the leak and Check Point's findings.

Update history

• 2026-10-12 — Luna Moth (Silent Ransom Group / UNC3753) Internal Playbook Leak Exposes Vishing-Driven Data Extortion Operations: What changed No severity, exploitability, status or attribution change; the existing HIGH / ACTIVE record is retained. Intelligence is enriched with Check Point's analysis of the leaked internal materials. New indicators (4) Indicator value
• 2026-10-10 — Silent Ransom Group (Luna Moth / UNC3753) Allegedly Extorted $207 Million From 27 Law Firms via Vishing and Data Theft Without Encryption: What changed No severity/exploitability/status change; existing values (HIGH / ACTIVE) already match the report. New indicators (3) Indicator values are withheld at this access level. New MITRE (4) Adds T1105 Ingress Tool Transfer, T1021.00
• 2026-10-09 — Silent Ransom Group (Luna Moth / UNC3753) Data-Theft Extortion of 27 Law Firms Without Encryption, per Leaked Chat Logs: What changed No field escalation warranted: severity, exploitability, status and attribution confidence already at or above what the new report supports (new report rates attribution MEDIUM; existing HIGH retained). New indicators (9) Indic

Sources cited for Luna Moth vishing physical intrusion

• FBI FLASH-20260526-01: Silent Ransom Group Impersonating IT Personnel Through Social Engineering ic3.gov · Government advisory · 2026-05-26
• FBI Cyber Alert: Silent Ransom Group Impersonating IT Personnel Through Social Engineering fbi.gov · Government advisory · 2026-05-26
• Silent Ransom Group Targeting Law Firms (FBI PIN 052325) fbi.gov · Government advisory · 2025-05-23
• Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms Google Cloud · Blog · 2026-06-05
• An Old Tactic Returns: Silent Ransom Group's Active Use of Physical Intrusion Against U.S. Law Firms halcyon.ai · Blog · 2026-06-01
• FBI Warns Silent Ransom Group Targeting U.S. Law Firms cyble.com · Blog · 2025-05-23
• Google and FBI warn of ransomware group that sends fake IT workers to hack victims in person techcrunch.com · News · 2026-06-05
• Silent Ransom Group Sends Operatives Into Law Firm Offices: 38 Firms Already Leaked techtimes.com · News · 2026-05-27
• FBI warns of Luna Moth extortion attacks targeting law firms BleepingComputer · News · 2025-05-23
• Hackers Are Calling Your Office: FBI Alerts Law Firms to Luna Moth's Stealth Phishing Campaign The Hacker News · News · 2025-05-23
• Silent Ransom Group Launches Vishing Attacks on Law Firms Dark Reading · News · 2025-05-23

Threats related to Luna Moth vishing physical intrusion

• Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical Intrusion)
• UNC3753 (Silent Ransom Group / Luna Moth) Escalation — Physical Office Intrusion & USB Data Exfiltration Against US Legal & Financial Services (FBI Flash CSA, 2026)
• Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusion
• Silent Ransom Group (Luna Moth / Chatty Spider / UNC3753) — IT Support Impersonation Campaign Targeting US Law Firms (FBI FLASH Advisory, May 2026)
• STAC4749 Campaign: Microsoft Teams Vishing Leads to Chaos Ransomware Deployment

Related coverage of this activity

• SopraVPN CERT-UA attribution
• GlobalProtect auth-override bypass
• Chaos Healthcare Highways breach
• Gentlemen ransomware worm spread
• Payouts King double extortion