Brand Impersonation Takedown: Why Manual Response Fails

## Executive summary: Between January and May 2026 Mandiant tracked UNC3753 (aka Luna Moth / Silent Ransom Group) conducting a nation-wide, financially motivated impersonation and extortion campaign against U.S. professional services firms that relied on phishing emails, phone-based social engineering, spoofed domains, and fake executive profiles; the report argues manual, ticket-based takedowns are too slow and recommends continuous monitoring, pre-verified alerts, and managed takedown services to shorten the exposure window from days to hours.