Google Warns of UNC6783 Campaign Targeting BPOs for Data Extortion
Summary
GTIG warns that UNC6783 targets BPOs and corporate helpdesk staff with phishing, spoofed Okta and Zendesk pages, and a clipboard-stealing kit to bypass MFA. A possible link to Mr. Raccoon and his Adobe data-theft claim remains unconfirmed.
Key points
- GTIG says financially motivated actor UNC6783 targets BPOs serving high-value companies, as well as their support and helpdesk staff.
- The actor reportedly uses live chats, spoofed Okta login pages, and a phishing kit that steals clipboard contents to bypass standard MFA verification.
- GTIG says fake Zendesk support pages impersonate targeted organizations, and attackers enroll their own devices using compromised employee accounts.
- The actor has also reportedly used fake security software updates to deliver remote-access malware and Proton Mail accounts to send extortion notes after data exfiltration.
- GTIG’s description suggests UNC6783 may be linked to Mr. Raccoon, who claimed to have stolen Adobe data from an Indian BPO; the article does not establish that link or confirm the theft.
- Mr. Raccoon claimed the data included information on 15,000 employees, support tickets, and bug-bounty submissions; Adobe had not responded to SecurityWeek at publication.
Article Details
- Event Type
- Phishing and social-engineering campaign targeting business process outsourcing organizations for data theft and extortion.
- Impact
- GTIG reports that UNC6783 has targeted dozens of high-value corporate entities and their BPO providers, using phishing, spoofed support and login pages, and remote access malware to obtain access and steal data. The actor has reportedly used stolen data for extortion. Mr. Raccoon claimed to have stolen Adobe data from a BPO firm in India, including information on 15,000 employees, millions of support tickets, and bug bounty submissions; these claims and the proposed link to UNC6783 are unconfirmed in the article.
MITRE ATT&CK
T1098 · Account ManipulationAfter obtaining employee accounts, the hackers reportedly enrolled their own devices to gain persistent access.T1115 · Clipboard DataThe phishing kit reportedly steals clipboard contents.T1204 · User ExecutionVictims were reportedly tricked into executing remote access malware and downloading fake security software updates.T1566 · PhishingUNC6783 reportedly uses phishing campaigns, including phishing emails targeting BPO employees.
People
Threat Actors
Mr. RaccoonA hacker using the Raccoon persona claimed to have stolen Adobe data from a BPO firm in India. GTIG's description reportedly suggests this hacker may be the same actor as UNC6783; the connection is not confirmed.UNC6783GTIG reports that this financially motivated tracked actor targets BPOs and corporate support staff through social engineering and phishing to gain access, steal data, and conduct extortion operations.
Products
OktaThe threat actor relies on live chats to lure employees to spoofed Okta login pages and uses a phishing kit that steals clipboard contents to bypass standard multi-factor authentication (MFA) verification.Proton MailFollowing data exfiltration, UNC6783 has been known to use Proton Mail accounts to deliver ransom notes for data theft extortion operations,” Larsen says.ZendeskAccording to GTIG, UNC6783’s social engineering tactics involve fake Zendesk support pages that pose as the targeted organization’s domain.