UNC3753 Hit U.S. Professional Services Firms With Vishing and Walk-In Intrusions
Dozens of legal and financial firms were hit between January and May 2026 in a data-theft extortion campaign that blended phone-based social engineering with physical office visits.
Key points
- Google Mandiant and the Google Threat Intelligence Group attributed a January, May 2026 data-theft extortion campaign to UNC3753.
- The group targeted dozens of U.S. Professional services organizations using help-desk calls and, in some cases, in-person office visits.
- Attackers exfiltrated files and threatened publication, placing UNC3753 in the same operational lane as Scattered Spider.
- No victims have been named publicly; breach-notification obligations are triggered regardless of whether ransomware was deployed.
- Clients of affected firms should ask specifically which document repositories were accessed.
What did UNC3753 actually do?
A financially motivated crew spent the first five months of 2026 working through U.S. Legal, financial, and consulting firms using phone calls and, where phones failed, physical visits to offices. Operators called help desks, talked past identity checks, and walked off with credentials or session tokens. No zero-days, no exotic malware. Process failures, exploited patiently.
Once inside, the goal was data rather than encryption. UNC3753 staged and exfiltrated files, then moved to extortion: pay, or the data gets published.
Why professional services?
These firms hold concentrated client data: privileged legal correspondence, M&A diligence, tax filings, beneficial-ownership records. That concentration means a single law firm compromise can cascade into client notifications across dozens of corporates, giving the attacker influence well beyond the breached firm itself.
The targeting mirrors what we reported on 7 June 2026 about Silent Ransom Group, where Mandiant tracked rapid data theft following fake IT-support calls against U.S. Law firms. UNC3753's walk-in component also echoes the FBI warning we covered on 30 May, which described actors posing as IT support and inserting storage devices into employee computers.
Should you worry about notification letters?
Neither Mandiant nor GTIG has named victims publicly. The campaign window suggests notification letters will start reaching state attorneys general soon. The New York Department of Financial Services and the California AG are likely to see heavy volume given the sector. The FTC retains jurisdiction over Safeguards Rule failings at non-bank financial firms, and state breach-notification obligations apply whether or not ransomware was deployed.
What should affected clients do?
If your law firm, accountant, or financial adviser sends a notice, ask which document repositories were accessed and whether matter files tied to your account were among the exfiltrated set. A letter saying only that an unauthorized third party accessed systems is not a sufficient answer.
Rotate any portal credentials you shared with the firm, and treat documents you uploaded, including tax records, identification, and deal terms, as potentially in attacker hands. Place a fraud alert or credit freeze if Social Security numbers or financial account numbers were in scope. Watch for follow-on vishing: crews that breach professional services firms routinely reuse stolen correspondence to impersonate partners and request wire transfers from clients.
What should firms do now?
Help desks and reception areas are Tier 1 attack surface, not administrative overhead. Pull call recordings from the January, May window, audit any out-of-band identity verification overrides, and confirm whether physical visitor logs match badge access events.
