Historical intelligence backfill. This assessment covers reporting originally published on 2026-06-05 and was added to the RWP archive on 2026-09-07.
Luna Moth called U.S. law firms as IT — the payload was AnyDesk, not a 0-day
Mandiant/GTIG 5 June 2026 — UNC3753 (Luna Moth / Chatty Spider / Silent Ransom Group) vished professional, legal, and financial services January–May. Screen-share plus RMM. Dozens of U.S. orgs. Data-theft extortion.
Bottom line up front
CONFIRMED 5 June 2026 Mandiant/GTIG — from January through May 2026, UNC3753 ran financially motivated data-theft extortion against dozens of U.S. professional, legal, and financial-services organizations. Voice phishing posing as IT. Pretexts: data migration or invoice email. Goal of the call: screen-share and a download of commercial RMM. Attribution to UNC3753 (Luna Moth, Chatty Spider, Silent Ransom Group) on infrastructure, registrar, victimology, staging directories. Active since at least March 2022.
Legal firms are the data lake: M&A, trade secrets, regulatory files. They pay quietly. That is the business model.
Do not collapse this into UNC6671 (August helpdesk-to-SSO) or UNC6040 (Salesforce Data Loader). Same theater, different tooling and cluster IDs.
What happened
Email lure → phone → RMM → collection → extortion. No need for a VPN 0-day if the user installs the support tool.
Why it matters
Law-firm IT is often thin relative to the sensitivity of the files. RMM allow-lists that include AnyDesk “for vendors” are the hole.
What is confirmed vs not
CONFIRMED GTIG campaign window, sector, TTPs, alias mapping.
UNKNOWN public victim count beyond “dozens.”
What defenders should do
- RMM install requires a ticket the user already opened — never from an inbound “IT” call.
- Block unsigned remote-support tools on attorney workstations.
- Tabletop: who gets the extortion email, and who is allowed to talk to the actor.
RWP assessment
Confidence: High. This is the spring chapter of the same helpdesk-crime year that UNC6671 wrote in August.
Historical intelligence backfill. This assessment covers reporting originally published on 2026-06-05 and was added to the RWP archive on 2026-09-07.
Sources
- GTIG/Mandiant — Targeted campaign against US law firms
- GTIG — UNC6671 vishing (later, distinct cluster)
- Industry aliases — Luna Moth, Chatty Spider, Silent Ransom Group (as listed by GTIG)