UNC3753 Extorts U.S. Law and Finance Firms via Vishing and Office Break‑Ins
Google Mandiant identified UNC3753, a financially motivated group, using voice‑phishing (vishing) and on‑site impersonation to infiltrate U.S. legal and financial firms from Jan‑May 2026. After gaining remote RMM access, attackers sometimes entered offices as fake IT staff to copy data onto USB drives, then extorted victims.