Google: UNC6783 Uses BPO Access to Target High-Value Companies
Summary
Google says UNC6783 targets BPO providers with social engineering and phishing to access high-value companies, steal data and extort victims. Its findings include spoofed Okta pages, clipboard theft to bypass MFA and fake updates delivering remote access malware.
Key points
- Google says UNC6783 has targeted dozens of corporate entities through BPO providers, while also contacting some organizations’ support and helpdesk staff directly.
- In live-chat social engineering, attackers direct support employees to spoofed Okta login pages on domains mimicking Zendesk patterns.
- The phishing kit can steal clipboard contents to bypass MFA and register an attacker-controlled device.
- Google observed fake security updates used to deliver remote access malware; the actor reportedly contacts victims with payment demands after stealing data.
- Google recommends FIDO2 security keys, monitoring live chat for abuse, blocking Zendesk-pattern spoofed domains and auditing MFA device enrollments.
- Google says UNC6783 may be linked to Raccoon. A person using the “Mr. Raccoon” alias claimed to have stolen 13 million Adobe support tickets and other data; Adobe has not confirmed the claim.
- The threat actor behind the CrunchyRoll breach reportedly claimed responsibility for the Adobe attack but provided no evidence.
Article Details
- Event Type
- Reported cyber intrusion and data-extortion campaign targeting business process outsourcing providers and their clients.
- Impact
- Google Threat Intelligence Group reported that dozens of corporate entities across multiple sectors were targeted, with sensitive data exfiltrated for extortion. The reported tactics include social engineering, phishing, clipboard theft to bypass MFA, and fake security updates used to deliver remote access malware. Mr. Raccoon claimed to have stolen 13 million Adobe support tickets and other data; Adobe has not confirmed the breach, and the article says no evidence was provided for the claim.
MITRE ATT&CK
People
Threat Actors
Mr. RaccoonUsed as an alias by someone who claimed responsibility for a breach of Adobe and the theft of 13 million support tickets and other data. Adobe had not confirmed the breach, and the article reports no evidence supporting the claim.RaccoonDescribed as a persona that has targeted BPO providers serving large companies. Researchers said Raccoon may be linked to UNC6783; the relationship is not confirmed in the article.UNC6783Google Threat Intelligence Group reported that UNC6783 compromises BPO providers and sometimes contacts support staff directly to access client organizations and exfiltrate data for extortion.
Products
OktaTheir tactics include social engineering, phishing to spoof Okta logins on Zendesk-patterned domains, clipboard-stealing phishing kits to bypass MFA, delivery of remote access trojans via fake security updates, andZendeskTheir tactics include social engineering, phishing to spoof Okta logins on Zendesk-patterned domains, clipboard-stealing phishing kits to bypass MFA, delivery of remote access trojans via fake security updates, and