UNC6783 Targets BPO Providers to Reach Larger Organizations
Summary
Google reports that UNC6783 targets BPO providers using phishing, live-chat impersonation and fake updates, with tools that can capture clipboard data and install remote access malware. Mandiant recommends FIDO2 keys and MFA-registration audits.
Key points
- Google Threat Intelligence Group reports that UNC6783 targets BPO providers as a route to larger organizations, with the activity affecting dozens of companies.
- Reported methods include phishing, social engineering and impersonating support interactions to trick employees into visiting fake Okta login pages.
- The phishing toolkit can capture clipboard data; the article says attackers use this to bypass MFA and register their own devices.
- The group has also distributed fake security updates that install remote access malware, and reportedly uses stolen information for extortion.
- Mandiant recommends FIDO2 hardware keys, monitoring live-chat systems, blocking domains mimicking Zendesk naming patterns and auditing MFA device registrations.
- The article describes an Adobe breach and theft of about 13 million support tickets as an unconfirmed claim by an individual using the “Mr. Raccoon” alias; a connection between UNC6783 and Raccoon is also presented as possible.
Article Details
- Event Type
- Reported cybercriminal campaign targeting business process outsourcing (BPO) providers as a pathway to access larger organizations.
- Impact
- Google Threat Intelligence Group reports that the activity has affected dozens of companies and involved theft of sensitive information for extortion. Reported methods include phishing, social engineering, live-chat impersonation, credential and clipboard-data capture, unauthorized MFA-device registration, and fake updates that install remote access malware. Separately, an individual using the alias “Mr. Raccoon” claimed an unconfirmed breach involving an India-based BPO associated with Adobe and the theft of approximately 13 million support tickets.
MITRE ATT&CK
T1098 · Account ManipulationThe article says attackers can register their own MFA devices within compromised systems.T1115 · Clipboard DataThe reported phishing toolkit can capture clipboard data.T1566 · PhishingThe article reports phishing schemes and counterfeit login pages used to trick employees into providing access.
People
Threat Actors
Mr. RaccoonAn individual using this alias claimed responsibility for a breach involving an India-based BPO associated with Adobe. The claim, including the alleged theft of approximately 13 million support tickets, has not been confirmed.RaccoonDescribed as a cybercriminal persona that has previously focused on BPO firms serving large enterprises. Investigators believe it may be connected to UNC6783.UNC6783Google Threat Intelligence Group reports that this cybercriminal group targets BPO providers using phishing, social engineering, live-chat manipulation, and fake updates, with reported data theft and extortion. Investigators believe it may be connected to the Raccoon persona.
Products
OktaAttackers deploy Okta-like fake login pages hosted on Zendesk-imitating domains to capture credentials.ZendeskGoogle’s analysis and Mandiant recommendations emphasize measures such as FIDO2 hardware keys, live-chat monitoring, blocking Zendesk-like domains, and auditing MFA device registrations to reduce risk.