Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

Mandiant researchers document UNC3753, a financially motivated threat group conducting voice phishing and social engineering attacks against U.S. legal firms from January to May 2026. The campaign involves RMM tool deployment, data exfiltration via cloud storage, and extortion demands, with some incidents involving physical office intrusions. Recommended defenses include rigid out-of-band identity verification controls for all external contractors.