UNC3753 Shifts to Data Theft Extortion, Targeting U.S. Legal and Financial Sectors A financially motivated threat actor tracked as UNC3753 (also known as Silent Ransom Group, Luna Moth, or Chatty Spider) has intensified attacks against U.S. legal, professional, and financial services between January and May 2026. Unlike traditional ransomware operations, the group now focuses on data theft extortion, exfiltrating sensitive corporate data and threatening to leak it via their LEAKEDDATA site unless victims comply with aggressive three-day ultimatums. The group employs a hybrid attack strategy, combining voice phishing (vishing) with physical office intrusions to bypass security controls. After gaining access, UNC3753 exploits Bring Your Own Device (BYOD) environments, hijacking personal endpoints to infiltrate corporate virtual desktop infrastructure (VDI). From there, they target mapped network drives and document management systems (e.g., iManage), prioritizing tax logs, audit files, and Social Security numbers. Stolen data is staged in local user profiles before exfiltration via WinSCP or actor-controlled cloud storage. Recent intelligence, including an FBI Cyber FLASH Alert, reveals an escalation in tactics: when remote access fails, the group dispatches operatives to physically infiltrate offices. Posing as contracted IT technicians, these individuals gain access to endpoints under the pretense of resolving "urgent security alerts," then extract data directly onto USB storage devices. This method bypasses network defenses entirely, exploiting weak physical security controls. Once data is exfiltrated, UNC3753 launches rapid extortion campaigns, sending unbranded emails within 30 minutes of network exit. Victims are given three days to negotiate before stolen data including proprietary legal agreements and financial records is published. To counter these threats, security teams are advised to enforce strict identity verification for on-site technicians, restrict unauthorized remote management (RMM) software, and disable USB mass storage access on corporate devices. Monitoring for high-volume SSH traffic and phishing domains mimicking internal help desks (e.g., -itdesk.com, -helpdesk.com) can aid in detection. Indicators of Compromise (IOCs) include the following IP addresses: - 192.236.147.131 - 192.236.147.138 - 193.141.60.212