# UNC3753 (Luna Moth / Silent Ransom Group) Vishing and Physical Intrusion Campaign Against US Law Firms

> Mandiant/Google Threat Intelligence Group documents an ongoing financially motivated data-theft extortion campaign (January-May 2026) by UNC3753 (Luna Moth, Chatty Spider, Silent Ransom Group) against dozens of US legal, financial, and professional services firms. The actor impersonates IT helpdesk staff via phone to obtain remote access, exfiltrates data through commercial RMM tools, WinSCP, and Rclone, then extorts victims via a leak site. An FBI FLASH alert (FLASH-20260526-01) confirms the campaign escalated to in-person physical office intrusions when remote social engineering fails.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-10-12T15:35:33.544Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2127
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-luna-moth-vishing-physical-intrusion-tl-2026-2127.webp?v=d5b01892 (Threadlinqs threat intel: Luna Moth: Vishing & In-Person Attacks: Detection & IOCs (TL-2026-2127) — High severity, 38 IOCs, 9 detection rules.)
- **ID:** TL-2026-2127
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Luna Moth (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 38 (3 shown free below)

## Description

UNC3753 — publicly tracked as Luna Moth, Chatty Spider, and Silent Ransom Group (SRG) — is a financially motivated, Russia-nexus extortion actor active since March 2022, formed in the wake of the Conti ransomware syndicate's collapse. The group does not encrypt victim data; it steals it and extorts victims with threats of public disclosure, a tactic it has run consistently even after briefly deploying LOCKBIT.BLACK ransomware in 2022 before deprioritizing encryption entirely.

The group's initial-access tradecraft has evolved through three distinct phases. From 2022 through early 2025 it ran callback-phishing campaigns: emails impersonating well-known subscription services (in the style of the related UNC2686/'BazarCall' cluster) prompted victims to call a fraudulent support number, where an operator talked them into installing remote-access software. In March 2025 the group pivoted to direct voice phishing (vishing): operators harvest employee phone numbers from public corporate websites, call posing as internal IT helpdesk or security staff, and use pretexts such as 'resolving a security issue' or a 'corporate data migration' to talk targets into a screen-sharing session (Zoom, Microsoft Teams, Microsoft Quick Assist, or Terminal Services) and then a commercial RMM install (AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM, typically delivered via a curl/msiexec one-liner and a self-destructing privnote[.]com link). A parallel, generic 'invoice' email lure ('hello, here is the invcoie we talked about yesterday') is used to prime targets ahead of the call, without any malicious attachment or link.

Beginning around April 2025, and confirmed as an active, ongoing tactic by the FBI in a May 26, 2026 TLP:CLEAR FLASH alert (FLASH-20260526-01), the group escalated further: when remote social engineering fails, an operator physically travels to the victim's office, poses as an IT technician needing to 'image a device' or 'create a local backup,' and attempts to exfiltrate data directly onto a USB storage device.

Once inside an environment — remotely or physically — operators move with unusual speed: full lifecycle from initial contact to data theft and extortion has been observed within a single business day, with staging beginning inside the first hour. They compromise personal (BYOD) laptops via the screen-sharing session, then pivot into the corporate environment through native VDI clients (Windows365.exe, Citrix). Inside the environment they enumerate local directories, mapped network drives, and OneDrive folders, and run targeted keyword searches inside legal document-management systems (iManage) for W-2/W-9/1099 tax forms, audit files, client agreements, and Social Security numbers. Staged data is exfiltrated via drag-and-drop into actor-controlled consumer cloud storage (renamed to mimic the victim's branding), portable WinSCP, or Rclone over SFTP, or forwarded from the victim's own mailbox to actor-controlled consumer email addresses. In one documented incident, 1.7GB was pulled via OneDrive and 14.4GB via WinSCP.

Extortion follows within roughly 30 minutes of the actor exiting the environment: a letter (subject line pattern '[Victim Name] has lost confidential data of their clients. Very Important!') gives the victim a 3-day deadline, threatening direct outreach to employees and clients, publication on the group's leak site (business-data-leaks[.]com, also referenced as 'LEAKEDDATA DLS'), regulatory fines, and client lawsuits. Reported ransom demands range from roughly $1 million to as much as $20 million per victim. Public reporting attributes at least 38 law firms with data already posted to the leak site and estimates more than 100 total attacks in the campaign window, with named victims including Orrick, Herrington & Sutcliffe (data posted January 2026 after declining to pay), Jones Day, Wood Smith Henning & Berman (Q1 2026), and Ropers Majeski (claimed May 6, 2026).

Targeting is concentrated on US-based professional services, with a strong emphasis on law firms (for privileged, high-leverage client data) and financial/insurance services. Mandiant and the FBI jointly recommend physical-access controls (visitor ID verification against pre-scheduled work orders, mandatory escort of technical personnel), RMM/screen-sharing application control, BYOD-aware conditional access restricting VDI/VPN to corporate-owned devices with MFA step-up, USB mass-storage lockdown via GPO/MDM, and application-level auditing (real-time bulk-download and search-spike alerting) on iManage, SharePoint, and corporate email.

## MITRE ATT&CK

- T1566.004 Phishing: Spearphishing Voice
- T1133 External Remote Services
- T1204.002 User Execution: Malicious File
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1569.002 System Services: Service Execution
- T1036.005 Match Legitimate Resource Name or Location
- T1135 Network Share Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1219 Remote Access Tools
- T1005 Data from Local System
- T1020 Automated Exfiltration
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
- T1583.001 Acquire Infrastructure: Domains
- T1656 Impersonation
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1657 Financial Theft
- T1105 Ingress Tool Transfer
- T1021.004 Remote Services
- T1083 File and Directory Discovery
- T1048 Exfiltration Over Alternative Protocol
- T1585.002 Establish Accounts: Email Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1070.001 Indicator Removal: Clear Windows Event Logs
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.002 OS Credential Dumping: Security Account Manager

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vishing-Delivered RMM Silent Install via curl+msiexec (Luna Moth/UNC3753) — SPL** (`TL-2026-2127-SPL-001`)

Detects the curl-download-then-silent-msiexec-install pattern UNC3753/Luna Moth/Silent Ransom Group operators use immediately after an IT-helpdesk-impersonation vishing call to push AnyDesk, Bomgar, Zoho Assist, or SuperOps RMM onto a victim endpoint, optionally correlated with DNS resolution of actor-registered lookalike domains (*-itdesk.com, *-it.com, *-helpdesk.com) or privnote.com used to deliver the install link during the call.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.004, T1204.002, T1059.003, T1569.002, T1133, T1219
- **Data sources:** sysmon, windows_security, dns, proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\curl.exe") CommandLine="*curl*" CommandLine="*-o*" CommandLine="*.msi*"
| eval stage="download"
| append [
    search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    Image="*\\msiexec.exe" CommandLine="*/quiet*"
    (CommandLine="*AnyDesk*" OR CommandLine="*Bomgar*" OR CommandLine="*ZohoAssist*" OR CommandLine="*SuperOps*")
    | eval stage="silent_install"
]
| append [
    search index=dns sourcetype="dns"
    (query="*-itdesk.com" OR query="*-it.com" OR query="*-helpdesk.com" OR query="privnote.com")
    | eval stage="lure_domain_resolution"
]
| stats earliest(_time) as first_seen latest(_time) as last_seen values(stage) as stages_seen values(CommandLine) as commands dc(stage) as stage_count by Computer, user
| where stage_count >= 2
| sort - last_seen
```

### Microsoft KQL

```kql
let RMMKeywords = dynamic(["AnyDesk","Bomgar","ZohoAssist","SuperOps"]);
let LureDomains = dynamic(["-itdesk.com","-it.com","-helpdesk.com","privnote.com"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("curl.exe") and ProcessCommandLine has "-o" and ProcessCommandLine has ".msi")
    or (FileName =~ "msiexec.exe" and ProcessCommandLine has "/quiet" and ProcessCommandLine has_any (RMMKeywords))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (LureDomains)
    | project DeviceName, RemoteUrl, NetTimestamp = Timestamp
) on DeviceName
| summarize Events = count(), Commands = make_set(ProcessCommandLine), LureHits = make_set(RemoteUrl) by DeviceName, AccountName, bin(Timestamp, 1h)
| where Events >= 1
```

### Sigma

```yaml
title: RMM Tool Silent Install via curl-Delivered MSI (Luna Moth / UNC3753 Vishing Chain)
id: 7a1c2f3e-9b4d-4e2a-8c6f-1d3e5a7b9c01
status: experimental
description: Detects a curl download of an MSI installer followed by a silent msiexec install of a commercial RMM tool (AnyDesk, Bomgar, Zoho Assist, SuperOps RMM), the delivery pattern UNC3753/Luna Moth/Silent Ransom Group uses immediately after a vishing call impersonating IT helpdesk staff.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms/
    - https://www.ic3.gov/CSA/2026/260526.pdf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.initial-access
    - attack.t1566.004
    - attack.t1133
    - attack.execution
    - attack.t1204.002
    - attack.t1059.003
    - attack.t1569.002
    - attack.lateral-movement
    - attack.t1219
    - attack.tool.anydesk
logsource:
    category: process_creation
    product: windows
detection:
    selection_download:
        Image|endswith: '\curl.exe'
        CommandLine|contains|all:
            - '-o'
            - '.msi'
    selection_install:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: '/quiet'
        CommandLine|contains:
            - 'AnyDesk'
            - 'Bomgar'
            - 'ZohoAssist'
            - 'SuperOps'
    condition: selection_download or selection_install
falsepositives:
    - Legitimate IT-managed software deployment via SCCM/Intune using similar msiexec silent-install syntax
    - Authorized helpdesk staff performing scripted RMM installs during onboarding
level: high
```

**Known false positives:**

- Legitimate IT-managed software deployment via SCCM/Intune using similar msiexec silent-install syntax
- Authorized helpdesk staff performing scripted RMM installs during onboarding

**Tuning notes:** Scope the lure-domain match to your own organization's naming pattern (e.g. <orgname>-itdesk.com) rather than a static list, and maintain an allow-list of company-approved RMM binaries/hash values to suppress alerts from legitimate IT deployment tooling.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vishing-Delivered RMM Silent Install via curl+msiexec (Luna Moth/UNC3753) — KQL (locked: unlock with TL Creds)
- BYOD-to-Corporate VDI Pivot & Targeted iManage Legal-Document Search (Luna Moth/UNC3753) — KQL (locked: unlock with TL Creds)
- WinSCP/Rclone Mass SFTP Exfiltration & USB Physical-Intrusion Data Theft (Luna Moth/UNC3753) — KQL (locked: unlock with TL Creds)
- Vishing-Delivered RMM Silent Install via curl+msiexec (Luna Moth/UNC3753) — Sigma (locked: unlock with TL Creds)
- BYOD-to-Corporate VDI Pivot & Targeted iManage Legal-Document Search (Luna Moth/UNC3753) — Sigma (locked: unlock with TL Creds)
- WinSCP/Rclone Mass SFTP Exfiltration & USB Physical-Intrusion Data Theft (Luna Moth/UNC3753) — Sigma (locked: unlock with TL Creds)
- BYOD-to-Corporate VDI Pivot & Targeted iManage Legal-Document Search (Luna Moth/UNC3753) — SPL (locked: unlock with TL Creds)
- WinSCP/Rclone Mass SFTP Exfiltration & USB Physical-Intrusion Data Theft (Luna Moth/UNC3753) — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 38)

Defanged, TLP:CLEAR.

- IP address: `192.236.147[.]131`
- Domain: `business-data-leaks[.]com`
- File hash: `598281d2c6de83adf1505ee6077608d0c043623d477e2884d36d65e90686d67a`

Full set of 38 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms](https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms/)
- [FBI FLASH-20260526-01: Silent Ransom Group Impersonating IT Personnel Through Social Engineering](https://www.ic3.gov/CSA/2026/260526.pdf)
- [FBI Cyber Alert: Silent Ransom Group Impersonating IT Personnel Through Social Engineering](https://www.fbi.gov/investigate/cyber/alerts/2026/silent-ransom-group-impersonating-it-personnel-through-social-engineering)
- [Google and FBI warn of ransomware group that sends fake IT workers to hack victims in person](https://techcrunch.com/2026/06/05/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person/)
- [An Old Tactic Returns: Silent Ransom Group's Active Use of Physical Intrusion Against U.S. Law Firms](https://www.halcyon.ai/ransomware-alerts/an-old-tactic-returns-silent-ransom-groups-active-use-of-physical-intrusion-against-u-s-law-firms)
- [Silent Ransom Group Sends Operatives Into Law Firm Offices: 38 Firms Already Leaked](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm)
- [FBI warns of Luna Moth extortion attacks targeting law firms](https://www.bleepingcomputer.com/news/security/fbi-warns-of-luna-moth-extortion-attacks-targeting-law-firms/)
- [Hackers Are Calling Your Office: FBI Alerts Law Firms to Luna Moth's Stealth Phishing Campaign](https://thehackernews.com/2025/05/hackers-are-calling-your-office-fbi.html)
- [Silent Ransom Group Launches Vishing Attacks on Law Firms](https://www.darkreading.com/endpoint-security/fbi-silent-ransom-group-vishing-law-firms)
- [FBI Warns Silent Ransom Group Targeting U.S. Law Firms](https://cyble.com/blog/fbi-warns-silent-ransom-targeting-us-law-firms/)
- [Silent Ransom Group Targeting Law Firms (FBI PIN 052325)](https://www.fbi.gov/file-repository/cyber-alerts/silent-ransom-group-targeting-law-firms-052325.pdf/view)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2127