UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign
UNC3753 uses vishing and physical intrusions for data theft extortion in the US.
UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG), has been conducting a data theft extortion campaign against US organizations since January 2026. The group uses vishing and social engineering to gain remote access, tricking victims into downloading RMM tools. In some cases, they have escalated to physical intrusions, posing as IT technicians to steal data via USB drives.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonUNC3753's successful campaign demonstrates how attackers combine vishing (voice phishing) with physical intrusions to bypass traditional security controls. The group exploited human vulnerabilities by impersonating IT support to trick employees into installing remote monitoring and management (RMM) tools, then escalated to physical break-ins when remote access wasn't sufficient. This multi-vector approach shows that organizations must defend against both digital social engineering and physical security threats. The campaign's success highlights critical gaps in employee training and physical access controls that allowed attackers to steal sensitive data through USB devices.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.