UNC3753 turns helpdesk vishing into rapid data theft

Mandiant reports that UNC3753 targeted dozens of US organizations across legal, professional, and financial services from January through May 2026. The financially motivated campaign used invoice-themed messages and direct phone calls from actors posing as internal IT staff. Targets were persuaded to open screen-sharing sessions, install remote monitoring and management software, or follow commands that gave the caller control of enterprise access [source-aa977c30763e1760].

The operational tempo raises the defensive priority. Mandiant observed complete intrusion sequences within one business day, with search, staging, and theft beginning in under an hour in recent cases. Extortion messages sometimes arrived within 30 minutes of the actor leaving the environment [source-aa977c30763e1760].

Observed intrusion path

The initial email often carried no malicious link or attachment. It established an invoice or migration pretext that made a later call appear plausible. During the call, the actor directed the target into Zoom, Microsoft Teams, Quick Assist, Microsoft Terminal Services, or a commercial remote-support session. Mandiant observed attempted or successful use of AnyDesk, Bomgar, Zoho Assist, and a SuperOps RMM agent. One observed command used curl to retrieve an MSI installer before silent execution with msiexec [source-aa977c30763e1760].

Some intrusions began on personal devices. The actor used a screen-sharing session on a BYOD endpoint, then relied on the victim's access to enter Windows 365 or Citrix-hosted corporate environments. Inside the enterprise session, the actor enumerated OneDrive content, mapped drives, and document-management repositories. Searches focused on tax records, audit material, client agreements, personally identifiable information, and other data with high extortion value [source-aa977c30763e1760].

The observed exfiltration methods included browser uploads to consumer file-sharing accounts, portable WinSCP or Rclone, and email to actor-controlled consumer accounts. In one incident, 1.7 GB left a local OneDrive folder through Google Drive, followed by 14.4 GB transferred from a VDI session with WinSCP [source-aa977c30763e1760]. These details support monitoring for volume, destination novelty, and tool execution together, rather than treating any one approved utility as malicious.

Physical access remains an assessed extension

The source also describes incidents in which people posing as technicians entered offices and attempted to copy endpoint data to USB storage. Mandiant assessed those incidents as likely associated with UNC3753 based on targeting, structure, and timing, but limited forensic evidence and the absence of later extortion prevented formal attribution [source-aa977c30763e1760]. Defenders should preserve that uncertainty while still reviewing visitor verification, escort procedures, endpoint service workflows, and removable-media policy.

ATT&CK-aligned behavior

The reported behavior supports Spearphishing Voice (T1566.004), External Remote Services (T1133), User Execution: Malicious File (T1204.002), Remote Access Software (T1219), Remote Desktop Protocol (T1021.001), SSH (T1021.004), Data from Local System (T1005), Exfiltration to Cloud Storage (T1567.002), and Exfiltration over Physical Medium (T1052.001) [source-aa977c30763e1760]. These mappings describe observed activity. They do not imply that every intrusion used every technique.

Detection and response priorities

Endpoint teams should inventory approved remote-support software and alert when an unapproved RMM installer, portable transfer utility, or remote-control tool appears. The included Sigma rule covers one narrow process pattern from the evidence: a Windows command line that combines curl, an MSI payload, and msiexec. It requires process-creation telemetry with full command lines. Legitimate software deployment scripts can match, so responders should confirm the parent process, signer, initiating user, destination, and change record.

Identity and network teams should correlate remote-support activity with first-seen BYOD or VDI access, unusual source locations, and high-volume transfers. Document platforms should retain search and download audit events and baseline mass access by user and repository. Egress monitoring should preserve destination category and byte counts for consumer storage, SFTP, and newly observed services. Security teams should also provide an out-of-band method for employees to verify unexpected helpdesk calls before sharing a screen or running a command.

Limitations

The supplied bundle contains one original research source. It supports the campaign narrative and observed behavior, but it does not independently corroborate every incident. The report lists infrastructure indicators without a precise observation date for each value, so this publication does not reproduce them or create an indicator-based hunt. The public detection is deliberately narrow and will not identify sessions conducted entirely through an already approved meeting tool or actions performed by the victim under verbal direction.

Source

• Mandiant and Google Threat Intelligence Group, "Ongoing Targeted Campaign Against US Law Firms," published 5 June 2026 [source-aa977c30763e1760].