UNC3753 (Silent Ransom Group) Escalates U.S. Law Firm Campaign to Physical Office Intrusions — Full Attack-to-Extortion in Under One Hour

Mandiant and Google GTIG published detailed TTPs for UNC3753 (Luna Moth / Chatty Spider / Silent Ransom Group), documenting a Jan–May 2026 campaign targeting dozens of U.S. legal, financial, and professional services firms via vishing, RMM tool abuse, and bulk exfiltration of M&A files, client trade secrets, and tax records. In a notable escalation corroborated by a prior FBI FLASH advisory, the group has physically sent individuals posing as IT technicians to victim offices to steal data via USB — compressing the full kill chain from initial contact to extortion demand to under 60 minutes in recent cases. The group operates entirely without ransomware encryption, relying on data-theft extortion with aggressive 72-hour deadlines and threats to notify clients and regulators directly.

The group operates entirely without ransomware encryption, relying on data-theft extortion with aggressive 72-hour deadlines and threats to notify clients and regulators directly.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.