UNC3753 - cURL SuperOps RMM Installer

Georg Lauenstein@gsec

•updated Jun 6, 2026•0•0•7

Detects cURL command used by UNC3753 to download SuperOps RMM agent during social engineering attacks. The threat actor instructs victims to execute this specific command pattern to install persistent remote access tools for data theft operations.