--- title: Ongoing Targeted Campaign Against US Law Firms | daily.dev description: Mandiant and Google Threat Intelligence Group detail an active financially motivated campaign by UNC3753 (Luna Moth/Silent Ransom Group) targeting US law firms... canonical: https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ongoing Targeted Campaign Against US Law Firms | daily.dev og:description: Mandiant and Google Threat Intelligence Group detail an active financially motivated campaign by UNC3753 (Luna Moth/Silent Ransom Group) targeting US law firms... og:url: https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn og:image: https://api.daily.dev/og/posts/R3Ufz8UZn.png og:image:alt: Ongoing Targeted Campaign Against US Law Firms og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ongoing Targeted Campaign Against US Law Firms **[Google Cloud](https://daily.dev/sources/gcp)** · 11 min read · 0 upvotes · 0 comments ## Summary Mandiant and Google Threat Intelligence Group detail an active financially motivated campaign by UNC3753 (Luna Moth/Silent Ransom Group) targeting US law firms and professional services organizations from January through May 2026. The group uses vishing and IT helpdesk impersonation to trick employees into installing RMM tools (AnyDesk, Bomgar, Zoho Assist) or joining screen-sharing sessions, then exfiltrates sensitive legal documents, PII, and financial records via WinSCP, Rclone, or consumer cloud storage. The entire attack cycle—from initial contact to data theft and extortion—can complete within a single business day. A notable escalation involves physical office intrusions where actors pose as IT technicians to exfiltrate data via USB. Extortion demands follow within 30 minutes of exit, threatening to publish data on the LEAKEDDATA site. Recommended mitigations include RMM application controls, BYOD conditional access policies, USB device restrictions, iManage/SharePoint bulk-download alerting, and physical visitor verification procedures. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Silent Ransom Group targets law firms with fake IT support calls](https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe) · BleepingComputer · 0 upvotes · 0 comments - [Google and FBI warn of ransomware group that sends fake IT workers to hack victims in person](https://daily.dev/posts/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person-ap1smzd0i) · TechCrunch · 0 upvotes · 0 comments - ['Several dozen' orgs targeted by a new extortion crew](https://daily.dev/posts/several-dozen-orgs-targeted-by-a-new-extortion-crew-hwkvov6ma) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ongoing Targeted Campaign Against US Law Firms","url":"https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn"},"datePublished":"2026-06-05T14:24:32.466Z","dateModified":"2026-06-05T14:24:56.275Z","description":"Mandiant and Google Threat Intelligence Group detail an active financially motivated campaign by UNC3753 (Luna Moth/Silent Ransom Group) targeting US law firms...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-exfiltration","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"Ongoing Targeted Campaign Against US Law Firms"}]} ```