Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

Mandiant identified a financially motivated data theft and extortion campaign by threat group UNC3753 targeting dozens of US professional, legal, and financial services organizations between January and May 2026. The group uses voice phishing and social engineering to gain remote access via screen-sharing sessions and RMM tools, then exfiltrates sensitive legal documents, PII, and financial records before demanding ransom under threat of public data leaks. The campaign is notable for completing the entire attack lifecycle within a single business day and for escalating to physical in-person intrusions to steal data via USB media.