UNC6783

Reported Context (4)

Google is tracking this financially motivated threat cluster, which reportedly targets organizations by compromising BPO providers and help desk staff for data extortion. Weekly Security Roundup Details Phorpiex Botnet, ActiveMQ RCE and AI-Related Threats
Google Threat Intelligence Group reports that this cybercriminal group targets BPO providers using phishing, social engineering, live-chat manipulation, and fake updates, with reported data theft and extortion. Investigators believe it may be connected to the Raccoon persona. UNC6783 Targets BPO Providers to Reach Larger Organizations
GTIG reports that this financially motivated tracked actor targets BPOs and corporate support staff through social engineering and phishing to gain access, steal data, and conduct extortion operations. Google Warns of UNC6783 Campaign Targeting BPOs for Data Extortion
Google Threat Intelligence Group reported that UNC6783 compromises BPO providers and sometimes contacts support staff directly to access client organizations and exfiltrate data for extortion. Google: UNC6783 Uses BPO Access to Target High-Value Companies

CVE (5)

Malware (13)

People (3)

Threat Actors (3)

MITRE ATT&CK (10)

Vendors (6)

Products (13)

Industries (7)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.