UNC3753 Infrastructure Connection

Duo Tech@duotech

•updated Jun 8, 2026•1•0•5

Detects DNS requests to domains matching known UNC3753 data leak sites or helpdesk impersonation patterns utilized during vishing campaigns. This rule specifically looks for the domain "business-data-leaks.com" and domains ending with "-itdesk.com", "-helpdesk.com", or "-it.com".