---
title: Ransomware Gang Uses Phone Calls to Hijack Company IT Systems Across US Industries
description: UNC3944 ransomware group targets US companies using phone scams to hijack IT systems. Google exposes their tactics, urging new cybersecurity strategies.
canonical_url: https://codekeeper.co/ticker/ransomware-gang-phone-hijack-us-industries
---

[Ransomware](https://codekeeper.co/ticker/tag/ransomware)

# Ransomware Gang Uses Phone Calls to Hijack Company IT Systems Across US Industries

UNC3944 ransomware group targets US companies using phone scams to hijack IT systems. Google exposes their tactics, urging new cybersecurity strategies.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 29, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Google researchers exposed UNC3944, a ransomware group targeting US retail, airline, and insurance companies through sophisticated phone scams. The hackers call IT help desks pretending to be employees, trick staff into resetting passwords, then use stolen credentials to access virtual server systems and deploy ransomware within hours. Unlike typical cyberattacks, they don't use malware but manipulate legitimate administrative tools, making detection extremely difficult. The group's activity declined after 2024 law enforcement actions. But other ransomware groups are now copying these tactics, making this a growing threat requiring immediate defensive action. Source: [Industrial Cyber](https://industrialcyber.co/threat-landscape/google-details-unc3944-ransomware-campaign-across-us-sectors-using-voice-phishing-admin-hijack-tactics/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-gang-phone-hijack-us-industries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[ShinyHunters Exploited Oracle Zero-Day to Hit Over 100 Organizations, Mostly Universities Aug 12, 2026](https://codekeeper.co/ticker/shinyhunters-oracle-peoplesoft-zero-day-breach)

[CISA Warns of Actively Exploited Zero-Day in Cisco Firewall Management Center Aug 11, 2026](https://codekeeper.co/ticker/cisa-warns-zero-day-flaw-cisco-fmc)

[Ransomware New 'SynkLoader' Malware Could Be Paving the Way for Ransomware Attacks Aug 25, 2026](https://codekeeper.co/ticker/synkloader-malware-phishlocker-sso-breach)

[Splunk Enterprise Hit by Critical Pre-Auth RCE Vulnerability Scoring 9.8 CVSS Aug 12, 2026](https://codekeeper.co/ticker/splunk-enterprise-vulnerability-cve-2026-20253)