Mandiant Details UNC3753 Data-Theft Extortion Campaign Against U.S. Firms
Summary
Mandiant describes a Jan–May 2026 UNC3753 campaign against dozens of U.S. legal, professional and financial organizations, using vishing and remote-support tools to steal sensitive files for extortion; it also details possible physical intrusions and defenses.
Key points
- Mandiant identified activity from January through May 2026 targeting dozens of U.S. legal, professional and financial services organizations.
- The group used invoice-themed messages and vishing, impersonating internal IT staff to persuade employees to join screen-sharing sessions and install remote-support tools.
- UNC3753 abused tools including Zoom, Teams, Quick Assist, AnyDesk, Bomgar and Zoho Assist, and used personal devices to access corporate VDI environments.
- Attackers searched file systems and iManage repositories for legal agreements, tax records, PII and financial files, then staged data for theft.
- Exfiltration methods included WinSCP, Rclone, consumer file-sharing accounts and email. In one incident, Mandiant observed 1.7 GB transferred to Google Drive and another 14.4 GB exfiltrated via WinSCP; Google disabled associated Drive accounts and assets.
- Extortion messages often followed data theft within 30 minutes, set a three-day response deadline and threatened publication on the LEAKEDDATA site.
- GTIG assesses that some physical office intrusions may be linked to UNC3753, but limited forensic evidence and no subsequent extortion attempt prevented formal attribution. Recommendations include visitor verification, RMM controls, USB restrictions and monitoring for bulk transfers.
Article Details
- Attack Vectors
- Vishing and IT helpdesk impersonation to persuade employees to join screen-sharing sessions and install remote access or RMM software.
- Invoice-themed emails used as pretexts for follow-up calls; the reported messages contained no active links or malicious attachments.
- Use of RMM and screen-sharing software, including attempts to stage a SuperOps RMM installer with a cURL command.
- Search and staging of sensitive documents from local directories, mapped network drives, OneDrive, and iManage repositories.
- Exfiltration through file-sharing accounts, Google Drive, WinSCP, Rclone, and victim email accounts.
- In possibly related physical incidents, individuals posing as technicians reportedly attempted to copy data from endpoints to USB storage.
- Defensive Notes
- Train users on the campaign’s vishing and helpdesk-impersonation tactics.
- Verify technicians out of band against scheduled work orders, check visitor identification, and escort technical visitors.
- Restrict RMM and screen-sharing software to approved applications and monitor for unauthorized installations or execution.
- Require corporate-owned devices and strong authentication, including MFA, for VDI and other remote access.
- Restrict external USB storage and monitor for unusual file searches, bulk downloads, and high-volume transfers.
- Alert on unauthorized file-sharing and email destinations, and audit access to document repositories such as iManage.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 174[.]169[.]162[.]62 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| IPV4 | 192[.]236[.]146[.]173 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| IPV4 | 192[.]236[.]147[.]131 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| IPV4 | 192[.]236[.]147[.]138 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| IPV4 | 192[.]236[.]154[.]158 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| IPV4 | 193[.]141[.]60[.]212 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| IPV4 | 64[.]94[.]84[.]97 | IPv4 address listed in the article’s campaign IOC table; its specific role is not stated. |
| URL | hxxps[:]//business-data-leaks[.]com | LEAKEDDATA site identified as the platform used to publish victims’ identities and compromised data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe group collected sensitive files from local systems and user-accessible folders before exfiltration.T1052.001 · Exfiltration over USBIn possibly related physical intrusions, individuals reportedly attempted to copy endpoint data to removable USB storage.T1059.003 · Windows Command ShellAn observed command used cURL to download a SuperOps installer and msiexec to run it.T1083 · File and Directory DiscoveryThe actors mapped directories, searched local folders, and located sensitive files for staging.T1135 · Network Share DiscoveryThe actors enumerated and searched mapped network drives.T1219 · Remote Access ToolsThe group used remote support and RMM software, including AnyDesk, Bomgar, Zoho Assist, and SuperOps RMM, to establish access.T1566.004 · Spearphishing VoiceUNC3753 used vishing, posing as IT helpdesk or security staff to persuade employees to provide access.T1567.002 · Exfiltration to Cloud StorageThe actors uploaded staged data to threat-actor-controlled file-sharing accounts, including a reported Google Drive account.
Threat Actors
Silent Ransom GroupIdentified in the article as an alternate tracking name for UNC3753, which is attributed the data-theft extortion campaign.UNC2686Described as a threat cluster that conducted Bazarcall-style campaigns and had TTP overlaps with UNC3753.UNC3753Mandiant and GTIG attribute the data-theft extortion campaign and related social-engineering operations to this financially motivated cluster.
Malware
BazarLoaderThe threat cluster relies heavily on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.LOCKBIT.BLACKUNC3753 deployed LOCKBIT.BLACK in 2022, but has since prioritized data theft extortion-only operations typically involving threats to post stolen files to the LEAKEDDATA DLS.SILENTNIGHTThe threat cluster relies heavily on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.TrickBotThe threat cluster relies heavily on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.UrsnifThe threat cluster relies heavily on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.
Vendors
GoogleGoogle Threat Intelligence Group (GTIG) assesses that the primary purpose of these emails is to establish a pretext, raising the target’s internal security concerns so they are more susceptible to follow-up voice calls.MicrosoftUNC3753 instructs targets to initiate remote desktop and support sessions using built-in or commercial services, including Zoom, Microsoft Terminal Services, Microsoft Teams, and Quick Assist.
Products
AnyDeskAttackers abused Zoom, Teams, Quick Assist, AnyDesk, and other RMM tools.BomgarUNC3753 frequently attempts to establish more persistent access by social engineering targets into downloading AnyDesk, Bomgar, or Zoho Assist installers.CitrixUsing these compromised personal laptops, they accessed corporate virtual desktop infrastructure (VDI) using native client platforms, such as Windows 365 (Windows365.exe) or Citrix clients.Google Drivethe threat group exfiltrated 1.7 gigabytes of data from a target’s local OneDrive folder to a Google Drive account before pivoting to a VDI session and exfiltrating an additional 14.4 gigabytes using WinSCP.iManageKeyword Search and File Staging: Threat actors use specific keyword search functions within iManage to locate highly sensitive folders containing tax logs (Forms W-2, W-9, and 1099), audit files, corporate clientMicrosoft OneDriveSystem Enumeration: The threat actors map local directories, enumerate active OneDrive folders, and crawl mapped network drives.Microsoft Quick AssistAttackers abused Zoom, Teams, Quick Assist, AnyDesk, and other RMM tools.Microsoft TeamsUNC3753 instructs targets to initiate remote desktop and support sessions using built-in or commercial services, including Zoom, Microsoft Terminal Services, Microsoft Teams, and Quick Assist.SuperOps RMMIn one engagement, the threat actor attempted to install a “SuperOps RMM agent” by convincing the target to download and execute a payload via a cURL command.Windows 365Using these compromised personal laptops, they accessed corporate virtual desktop infrastructure (VDI) using native client platforms, such as Windows 365 (Windows365.exe) or Citrix clients.Zoho AssistUNC3753 frequently attempts to establish more persistent access by social engineering targets into downloading AnyDesk, Bomgar, or Zoho Assist installers.ZoomAttackers abused Zoom, Teams, Quick Assist, AnyDesk, and other RMM tools.
Tools
Countries
Industries
Financial Servicesprofessional, legal, and financial services organizations.Legal servicesLegal services firms represent high-value targets for extortion actors.Professional ServicesThe targeting of US legal and professional services organizations by financially motivated actors is a persistent industry risk.