[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fexoit72kbYvMaJ0bK9IDfoedxAtm8Jh0nGjxcj4eWQU":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"65a01a96-a31b-4656-8b7d-979b7a100650","UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign","unc3753-used-vishing-and-physical-intrusions-in-u-s-data-theft-extortion-campaig-f865cc","Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as","UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG), has been conducting a data theft extortion campaign against US organizations since January 2026. The group uses vishing and social engineering to gain remote access, tricking victims into downloading RMM tools. In some cases, they have escalated to physical intrusions, posing as IT technicians to steal data via USB drives.","UNC3753 uses vishing and physical intrusions for data theft extortion in the US.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Func3753-used-vishing-and-physical.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjoUzV1qMNLxMhQ6z22gKy4A5VPPrLn4b1nlfLaMyR6dBM6ostnGD8O3jiaPdM_diQNx24uX-TbI6iiX0Yw4m7msT6_3_UFz_g-g1fQGh3J55fzWzRyKTel4uIp05eBMvxwaQWvNv-VM0_p9jkclDuIyq0Ztu8r4gHIKN1xNSoGYV8Lj31kb_mCcZcBeXrB\u002Fs1600\u002Fvishing.jpg","2026-06-08T07:39:28+00:00","2026-06-08T10:00:13.605066+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"UNC3753","threat_actor",{"name":21,"type":19},"Chatty Spider",{"name":23,"type":19},"Luna Moth",{"name":25,"type":19},"Silent Ransom Group (SRG)",{"name":27,"type":19},"UNC2686",{"name":29,"type":19},"Conti","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[],{"controls":49,"vendors":131},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":109,"name":110,"problem":111,"products":112},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[113,118,124],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":114,"product_name":115,"url":116,"description":117},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":128,"url":129,"description":130},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[132],{"slug":133,"name":134,"logo_path":135,"roles":136},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":149},"social-engineering-and-physical-security-failures-enable-data-theft-campaign","Social Engineering and Physical Security Failures Enable Data Theft Campaign","UNC3753's successful campaign demonstrates how attackers combine vishing (voice phishing) with physical intrusions to bypass traditional security controls. The group exploited human vulnerabilities by impersonating IT support to trick employees into installing remote monitoring and management (RMM) tools, then escalated to physical break-ins when remote access wasn't sufficient. This multi-vector approach shows that organizations must defend against both digital social engineering and physical security threats. The campaign's success highlights critical gaps in employee training and physical access controls that allowed attackers to steal sensitive data through USB devices.",[143,144,145,146,147,148],"CIS Control 14 (Security Awareness)","CIS Control 6 (Access Control Management)","NIST AC-2 (Account Management)","NIST AT-2 (Security Awareness Training)","NIST PE-2 (Physical Access Authorizations)","NIST SI-4 (Information System Monitoring)",{}]