cyber.hendryadrian.com
Security News · bleepingcomputer.com

UNC6671 Linked to Vishing Attacks on Hedge Funds and Private-Equity Firms

· Original article ↗

Summary

Google GTIG attributes a wave of vishing attacks on financial firms to UNC6671, linked to the BlackFile extortion campaign. Attackers reportedly stole cloud credentials and session cookies; Point72 and Two Sigma described differing outcomes.

Key points

  • Google GTIG tracks the vishing activity as UNC6671 and assesses that one core intrusion group operates across the BlackFile, Redact, Pink, Helix, and Falcon extortion brands.
  • Attackers reportedly impersonated corporate help desks and directed employees to adversary-in-the-middle phishing pages to steal credentials and session cookies.
  • The attackers reportedly used stolen Microsoft 365 or Okta accounts to access linked cloud services, steal data, and delete security notifications and password-reset emails.
  • Reuters and Bloomberg reported that Point72, Millennium, Two Sigma, Citadel, and private-equity firms were targeted. Point72 reportedly found no evidence of client data theft; Two Sigma said it blocked an attempted intrusion and found no indication its systems or data were affected.
  • Mandiant says it is assisting several dozen organizations it describes as compromised by UNC6671.
  • GTIG distinguishes UNC6671 from Scattered Spider (UNC3944), noting similarities in help-desk vishing but different infrastructure and extortion networks.

Article Details

Event Type
Vishing-led credential theft and extortion campaign targeting financial organizations
Impact
Attackers reportedly stole credentials and session cookies, accessed Microsoft 365 or Okta accounts, and stole data from connected cloud services. Point72 reportedly found no evidence that client data was stolen; Two Sigma said it blocked an attempted intrusion and found no indication its systems or data were affected. Mandiant said it was assisting several dozen organizations compromised by UNC6671.

MITRE ATT&CK

T1078.004 · Cloud AccountsAttackers reportedly used stolen Microsoft 365 or Okta single sign-on accounts to access connected cloud platforms.T1530 · Data from Cloud StorageThe attackers reportedly used automated tools to steal data from cloud services they accessed.T1557 · Adversary-in-the-MiddleThe article describes adversary-in-the-middle phishing kits that intercepted credentials and session cookies in real time.T1566.004 · Spearphishing VoiceUNC6671 operators reportedly used voice phishing, impersonating corporate help desks to direct employees to phishing sites.

People

Austin LarsenPrincipal threat analyst at Google’s Threat Intelligence Group; he said GTIG tracks the activity as UNC6671 and assessed that one core intrusion group drives the activity across multiple extortion brands.

Threat Actors

UNC6671GTIG tracks the vishing activity as UNC6671. The article reports that the group impersonated corporate help desks, used adversary-in-the-middle phishing to steal credentials and session cookies, accessed cloud services, and extorted organizations. GTIG assesses that one core intrusion group operates across multiple public extortion brands.

Vendors

GoogleIn response to questions from BleepingComputer, Austin Larsen, a principal threat analyst at Google’s Threat Intelligence Group (GTIG), said the company tracks the vishing activity as UNC6671.MandiantMandiant says it is helping several dozen compromised organizations.

Products

Microsoft 365 Apps for EnterpriseThe attackers used help-desk impersonation and cloud phishing to steal credentials, access Microsoft 365 and Okta accounts, and extort organizations including Point72, Two Sigma, Millennium, and Citadel.OktaThe attackers used help-desk impersonation and cloud phishing to steal credentials, access Microsoft 365 and Okta accounts, and extort organizations including Point72, Two Sigma, Millennium, and Citadel.

Industries

Financial-rating agenciestargeting switched in July 2026 toward private-equity firms, hedge funds, major law firms, and financial-rating agencies after previously targeting organizations in the manufacturing, healthcare, real-estate,Healthcarelaw firms, and financial-rating agencies after previously targeting organizations in the manufacturing, healthcare, real-estate, technology, transportation, and hospitality sectors.Hedge fundsA wave of vishing attacks against hedge funds and private-equity firms has been attributed to UNC6671, a group linked to the BlackFile extortion campaign.HospitalityBlackFile is a data theft extortion group that first emerged in February 2025 when it conducted a wave of attacks targeting retail and hospitality organizations.Manufacturingfunds, major law firms, and financial-rating agencies after previously targeting organizations in the manufacturing, healthcare, real-estate, technology, transportation, and hospitality sectors.RetailBlackFile is a data theft extortion group that first emerged in February 2025 when it conducted a wave of attacks targeting retail and hospitality organizations.Technologyagencies after previously targeting organizations in the manufacturing, healthcare, real-estate, technology, transportation, and hospitality sectors.Transportationafter previously targeting organizations in the manufacturing, healthcare, real-estate, technology, transportation, and hospitality sectors.

Related Articles