Die Google Threat Intelligence Group warnt vor der Gruppe UNC3753. Die Angreifer geben sich vor Ort als IT-Techniker aus, um Daten per USB-Stick zu stehlen.

The cyber threat actor Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, is targeting law firms using information technology (IT) themed social engineering calls, then se...

UNC3753 phones staff posing as IT, hijacks screen sessions, steals sensitive legal files, and now sends operatives physically into offices to plug in USB drives.

UNC3753 phones staff posing as IT, hijacks screen sessions, steals sensitive legal files, and now sends operatives physically into offices to plug in USB drives. Google Mandiant and the Google Threat Intelligence Group published a detailed report documenting an active extortion campaign carried out by the cybercrime group UNC3753 (aka Luna Moth, Chatty Spider, and […]

UNC3753 hit dozens of U.S. firms in Jan-May 2026 using vishing and RMM tools, driving rapid data theft extortion.

UNC3753 hit dozens of U.S. firms in Jan-May 2026 using vishing and RMM tools, driving rapid data theft extortion.

Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as

The Silent Ransom Group is targeting U.S. law firms and professional services organizations with invoice-themed phishing, impersonation of IT staff, and remote support abuse to steal sensitive data within hours. Mandiant and the FBI say the gang, also tracked as UNC3753, Luna Moth, and Chatty Spider, uses aggressive extortion tactics and fast-moving infrastructure to pressure victims into paying. #SilentRansomGroup #UNC3753 #LunaMoth #ChattySpider #Mandiant #FBI

Silent Ransom Group is targeting U.S. law firms and professional services organizations with fake IT support calls, remote access tools and rapid data-theft extortion. Mandiant links the activity to UNC3753, Luna Moth

Die Google Threat Intelligence Group warnt vor der Gruppe UNC3753. Die Angreifer geben sich vor Ort als IT-Techniker aus, um Daten per USB-Stick zu stehlen.

Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as

Eine bislang unbekannte Cyberkriminellen-Gruppe treibt in den USA ihr Unwesen und hat es gezielt auf die Rechtsbranche abgesehen. Das FBI schlägt Alarm.Die als Silent Ransom Group bekannte Bande gibt sich als IT-Support-Mitarbeiter aus, um sich Zugang zu Firmennetzwerken zu verschaffen. Die Täter, die auch unter den Namen Luna Moth, Chatty Spider oder UNC3753 auftreten, setzen […] The post Silent Ransom Group: FBI warnt vor dreisten Hacker-Angriffen auf Kanzleien appeared first on BornCity.

Cyberkriminelle setzen zunehmend auf perfide Methoden – von gefälschten IT-Anrufen bis zu Einbrüchen in Büros.Sicherheitsforscher von Google Mandiant und Palo Alto Networks schlagen Alarm: Gleich zwei neue Erpressergruppen, bekannt als UNC3753 und Pink, treiben ihr Unwesen. Statt auf klassische Ransomware setzen die Banden auf schnellen Datendiebstahl, Telefon-Tricks und sogar physische Einbrüche in Firmengebäude. Die Warnungen […] The post UNC3753 und Pink: Datendiebstahl in unter einer Stunde appeared first on BornCity.

Die Bedrohungslage hat eine neue Qualität erreicht, bei der die Grenzen zwischen Spionage, Erpressung und Sicherheitsverletzungen verschwimmen. Neben technischer Raffinesse setzen Kriminelle verstärkt auf soziale Manipulation und künstliche Intelligenz.Physische Infiltration als neue EskalationsstufeSicherheitsanalysten beobachten eine besorgniserregende Entwicklung bei der Silent Ransom Group (SRG). Die Gruppe, auch bekannt als UNC3753 oder Luna Moth, hat zwischen Januar […] The post Hacker-Gruppe SRG: Physische Infiltration und Erpressung in unter einer Stunde appeared first on BornCity.

Die Cyberkriminalität wird immer dreister: Die Gruppe UNC3753 – auch bekannt als Silent Ransom Group (SRG), Luna Moth oder Chatty Spider – schleust jetzt eigene Leute in Firmengebäude. Statt nur digital zuzuschlagen, versuchen die Täter als IT-Techniker getarnt, vor Ort Daten zu stehlen.AnzeigeIT-Sicherheit stärken ohne teure Investitionen: So schützen clevere Unternehmer ihre Firma vor Cyberangriffen. […] The post UNC3753 greift Banken an: Datendiebstahl in unter einer Stunde appeared first on BornCity.

UNC3753 hit dozens of U.S. firms in Jan-May 2026 using vishing and RMM tools, driving rapid data theft extortion.

 The FBI said that over the last two years, an extortion group known as the Silent Ransom Group has targeted U.S. law firms through callback phishing and social engineering tactics.  This threat outfit, also known as Luna Moth, Chatty Spider, and UNC3753, has been active since 2022. It was also responsible for BazarCall campaigns, which provided initial access to corporate networks for Ryuk and Conti ransomware assaults. Following Conti's shutdown in March 2022, the threat actors broke away from the cybercrime syndicate and created their own operation known as the Silent Ransom Group. In recent attacks, SRG mimics the targets' IT help via email, bogus websites, and phone conversations, gaining access to their networks via social engineering tactics. This extortion group does not encrypt victims' systems and is infamous for demanding ransoms in order to keep sensitive information stolen from hacked devices from being leaked online.  "SRG will then direct the employee to join a remote access session, either through an email sent to them, or navigating to a web page. Once the employee grants access to their device, they are told that work needs to be done overnight," the FBI stated in a private industry notification. "Once in the victim's device, a typical SRG attack involves minimal privilege escalation and quickly pivots to data exfiltration conducted through 'WinSCP' (Windows Secure Copy) or a hidden or renamed version of 'Rclone.'”  After acquiring the victims' data, they use ransom emails to blackmail them, threatening to sell or publish the information. They frequently call employees of breached organisations and force them into ransom negotiations. While they have a dedicated website for disclosing their victims' data, the FBI claims the extortion ring does not always followup on its data leak promises.  To guard against these attacks, the FBI recommends adopting strong passwords, activating two-factor authentication for all employees, performing regular data backups, and teaching personnel on recognising phishing efforts. The FBI's warning follows a recent EclecticIQ report detailing SRG attacks targeting legal and financial institutions in the United States, with attackers observed registering domains to "impersonate IT helpdesk or support portals for major U.S. law firms and financial services firms, using typosquatted patterns.” A recent EclecticIQ report about SRG attacks against American legal and financial institutions revealed that the attackers were registering domains to "impersonate IT helpdesk or support portals for major U.S. law firms and financial services firms, using typosquatted patterns." The FBI issued the warning in response to this information.  Malicious emails with fake helpdesk numbers are being sent to victims, prompting them to call in order to fix a variety of non-existent issues. On the other hand, Luna Moth operators would try to deceive employees of targeted firms into installing remote monitoring & management (RMM) software via phoney IT help desk websites by posing as IT staff. Once the RMM tool is installed and started, the threat actors have direct keyboard access, allowing them to search for valuable documents on compromised devices and shared drivers, which will then be exfiltrated via Rclone (cloud syncing) or WinSCP (SFTP). According to EclecticIQ, the Silent Ransom Group sends ransom demands ranging from one to eight million USD, depending on the size of the hacked company.

 The FBI has issued a warning about a sophisticated cybercriminal group known as the Silent Ransom Group (SRG), also referred to by aliases like Luna Moth, Chatty Spider, and UNC3753. This group has been actively targeting U.S.-based law firms and related organizations through advanced phishing techniques and social engineering scams. The group, which has been operational since 2022, is known for using deceptive communication methods to gain unauthorized access to corporate systems and extract sensitive legal data for ransom demands. In the past, SRG’s activities spanned across industries such as healthcare and insurance.  However, since the spring of 2023, its focus has shifted to legal entities, likely because of the highly confidential nature of the data managed by law firms. The group commonly uses a method called callback phishing, also known as reverse vishing. In this approach, victims receive emails that appear to originate from reputable companies and warn them of small charges for fake subscriptions. The emails prompt users to call a phone number to cancel the subscription. During these calls, victims are instructed to download remote access software under the guise of resolving the issue. Once the software is installed, SRG gains control of the victim’s device, searches for valuable data, and uses it to demand ransom.   In March 2025, SRG has adapted their strategy to include voice phishing or vishing. In this new approach, the attackers call employees directly, posing as internal IT staff. These fraudulent callers attempt to convince their targets to join remote access sessions, often under the pretext of performing necessary overnight maintenance. Once inside the system, the attackers move swiftly to locate and exfiltrate data using tools like WinSCP or a disguised version of Rclone. Notably, SRG does not prioritize escalating privileges, instead focusing on immediate data theft. The FBI noted that these voice phishing methods have already resulted in multiple successful breaches.  SRG reportedly continues to apply pressure during ransom negotiations by making follow-up calls to victim organizations. While the group does maintain a public site for releasing stolen data, its use of this platform is inconsistent, and it does not always follow through on threats to leak information. A significant concern surrounding these attacks is the difficulty in detection. SRG uses legitimate system management and remote access tools, which are often overlooked by traditional antivirus software. The FBI advises organizations to remain vigilant, particularly if there are unexplained downloads of programs such as AnyDesk, Zoho Assist, or Splashtop, or if staff receive unexpected calls from alleged IT personnel.  In response, the FBI urges companies to bolster cybersecurity training, establish clear protocols for authenticating internal IT requests, and enforce two-factor authentication across all employee accounts. Victims of SRG attacks are encouraged to share any information that might assist in ongoing investigations, including ransom communications, caller details, and cryptocurrency wallet data.

Silent Ransom Group (SRG), also tracked as Chatty Spider, Luna Moth, and UNC3753, is using fast flux infrastructure built on infected devices to conceal its operations while conducting vishing and social engineering attacks. The group targets law firms and other sensitive industries for data theft and extortion, with its activity linked...