Reported by 1 outlet

Timeline

1. original reporting

   UNC3753 (Luna Moth) Targets US Law Firms with Vishing + Physical Office Intrusions — FBI Corroborates, Single-Day Attack-to-Exfiltration Cycle

   cyberpress.org · 130d ago · June 6th, 2026

   Mandiant's Google Threat Intelligence Group (GTIG) disclosed an active, financially motivated campaign by threat cluster UNC3753 (aka Luna Moth, Chatty Spider, Silent Ransom Group) targeting dozens of US-based legal, professional, and financial services organizations. The campaign combines voice phishing, commercial RMM tools, and — in a significant tactical escalation — physical office intrusions corroborated by an FBI Cyber FLASH Alert.

   Attack flow: The chain begins with benign invoice-themed emails carrying no malicious payloads — simply priming targets for a follow-up call. Threat actors then call employees (details harvested from corporate websites), impersonating internal IT helpdesk or security teams. Victims are guided to install legitimate RMM tools (AnyDesk, Bomgar, Zoho Assist, SuperOps) via Privnote self-destructing links. Once inside, attackers pivot from BYOD endpoints through corporate VDI using Windows 365 and Citrix clients.

   Extortion velocity: In multiple confirmed incidents, the full sequence from initial contact to data theft and extortion completed within a single business day. Staging and exfiltration began in under an hour in some cases. Attackers target iManage document repositories for W-2s, W-9s, SSNs, client agreements, and audit records. Exfiltration uses Google Drive (observed: 1.7 GB), WinSCP (additional 14.4 GB in one case), and Rclone. Extortion emails arrive within 30 minutes of exit, giving organizations three days to negotiate or face data publication on the LEAKEDDATA site at business-data-leaks[.]com.

   Physical escalation: Individuals posing as IT technicians have physically entered corporate offices attempting to exfiltrate data via USB storage media — a convergence of digital and physical threat vectors rarely seen in extortion campaigns.

   IOCs: C2 IPs include 192.236.147.131, 192.236.147.138, 193.141.60.212, 64.94.84.97. Phishing domains follow the pattern <org>-itdesk[.]com.

   Mitigation: Enforce application control (WDAC) to block unauthorized RMM binaries; disable USB read/write via GPO/MDM; enable MFA on iManage, SharePoint, and VDI entry points; monitor SSH port 22 for high-volume WinSCP/Rclone transfers from internal VDIs.

   ---