News Summary

• Researchers have disclosed details of a financially motivated data theft extortion campaign.
• The activity has been attributed by Google Mandiant to a threat actor dubbed UNC3753.
• Stolen information includes proprietary legal agreements, personally identifiable information (PII), and financial records.
• The group has mainly focused on extortion-only operations since 2022, pressuring victims to pay up or risk getting their data published on the LEAKEDDATA data leak site.
• It shares tactical overlaps with UNC2686, a threat cluster previously known for carrying out BazarCall-style campaigns in 2021.