The threat cluster UNC3753 executed a targeted data theft and extortion campaign against US-based professional, legal, and financial organizations from January through May 2026. Attackers employ voice phishing and social engineering to gain remote access by posing as IT support, facilitating screen-sharing sessions and installation of remote monitoring and management utilities. Once inside, they conduct rapid searches for sensitive data including proprietary legal agreements, personally identifiable information, and financial records, exfiltrating this data for extortion. The entire attack lifecycle can occur within a single business day, with data theft initiated in under an hour in recent cases. Additionally, attackers have physically infiltrated victim offices, impersonating IT technicians to directly exfiltrate data using USB storage devices. The campaign is linked to multiple malware families and threat tags such as SilentNight, BazarLoader, Ursnif, TrickBot, and LockBit.Black. No known exploits or patches are associated with this campaign as it relies on social engineering and physical intrusion rather than software vulnerabilities.

The campaign results in theft of highly sensitive data including proprietary legal agreements, personally identifiable information, and financial records from targeted US organizations. This data theft supports extortion demands, potentially causing financial loss, reputational damage, and legal consequences for victims. The rapid execution of attacks within a business day increases the challenge of timely detection and response. Physical intrusions further elevate risk by bypassing digital defenses. No direct software vulnerabilities are exploited, but the impact is significant due to data compromise and extortion.

No official patches or fixes are applicable as this campaign exploits social engineering and physical access rather than software vulnerabilities. Organizations should enhance user awareness training focused on recognizing voice phishing and social engineering attempts, especially those impersonating IT support. Implement strict verification procedures for remote support requests and physical access to IT environments. Employ multi-factor authentication and endpoint monitoring to detect unauthorized remote sessions. Physical security controls should be reinforced to prevent unauthorized personnel from accessing corporate offices and systems. Since no vendor advisory or patch is available, continuous vigilance and user education are critical.