UNC3753, also known as Silent Ransom Group, Luna Moth, and Chatty Spider, is running a fast, financially motivated data-theft extortion campaign against US legal, professional, and financial services firms (tracked from January to May 2026). The group starts with benign invoice-themed emails from consumer accounts to create a pretext, then follows up with vishing calls while impersonating internal IT helpdesk staff. Victims are guided into Zoom/Teams/Quick Assist sessions and convinced to install legitimate RMM tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, often with links and commands shared via self-destructing notes on privnote[.]com. Once they have remote access (sometimes via BYOD devices into corporate VDI) UNC3753 rapidly searches iManage, OneDrive, and network shares for contracts, tax files, SSNs, and sensitive client documents, then exfiltrates data using WinSCP, Rclone, cloud storage, or email forwarding. In some cases, actors physically visit offices posing as IT technicians and copy data to USB drives. Extortion emails typically arrive within thirty (30) minutes, give victims three (3) days to respond, and threaten to notify clients and leak data on the business-data-leaks[.]com site, which is protected by DNS fast-flux infrastructure. The entire attack cycle often completes within a single business day.