Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

UNC3753 executes a financially motivated extortion campaign targeting US law firms through social engineering and vishing from January to May 2026.

• •Invoice-themed emails establish pretext for phone calls impersonating IT support to initiate screen-sharing sessions
• •Legitimate tools including Zoom, Teams, AnyDesk, and Bomgar are exploited to gain remote access and bypass security controls
• •BYOD endpoints compromised to pivot into corporate VDI environments and access sensitive legal documents
• •Sensitive files including legal agreements, tax records, and SSNs are exfiltrated via cloud storage, WinSCP, or email
• •Aggressive extortion includes 3-day deadline with threats to publish data and contact clients and employees