UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign

UNC3753 is a financially motivated threat actor conducting data theft and extortion campaigns using vishing and physical intrusions.

• •Uses voice phishing, social engineering, and RMM utilities to gain remote access to corporate networks
• •Conducts physical intrusions posing as IT technicians to steal data via USB media
• •Exfiltrates stolen data including legal agreements, PII, and financial records via WinSCP or Rclone
• •Targets legal services firms and completes end-to-end operations from initial contact to extortion within a single business day
• •Uses DNS Fast Flux networks across 18 countries and 22 ISPs to evade takedowns

This summary was automatically generated by AI based on the original article and may not be fully accurate.