Silent Ransom Group (UNC3753) Escalates to Physical Office Intrusions Against U.S. Law Firms — Mandiant + FBI FLASH Confirm Data-Theft Compressed to Sub-Hour Timeline

Mandiant and the FBI have jointly confirmed that Silent Ransom Group (also tracked as UNC3753, Luna Moth, and Chatty Spider) targeted dozens of U.S. legal, financial, and professional-services organizations between January and May 2026, with some intrusions progressing from initial vishing contact to data exfiltration and extortion demand delivery in under one hour. The group's attack chain — invoice-themed lure email, fake IT support callback, RMM tool installation, WinSCP/Rclone exfiltration — requires no malware and leaves minimal forensic artifacts, making detection extremely difficult. Uniquely, the FBI has confirmed physical in-person office visits by operatives posing as IT staff who inserted USB storage devices to exfiltrate data, a tactic with no known parallels in the broader ransomware ecosystem. Resecurity also reports the group is now operating its leak site infrastructure behind fast-flux DNS spanning 18 countries.

Resecurity also reports the group is now operating its leak site infrastructure behind fast-flux DNS spanning 18 countries.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.