Hackers use simple phone trick to hold Wall Street giants hostage in ransom plot: report - New York Post

Ransom-seeking hackers have mounted a coordinated campaign targeting dozens of major US financial institutions and businesses over the past month, according to a disclosure from Google released this week. The threat actors employed a notably simple yet effective attack vector: impersonating corporate IT help desk personnel via phone calls to extract sensitive credentials and data from unwitting employees.

Google's Threat Intelligence Group identified confirmed targets spanning the financial services, private equity, and ratings agency sectors. The named targets include Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody's. According to Reuters, the attackers also constructed custom phishing websites specifically designed to steal passwords from employees at private equity and financial services firms. Google confirmed that some unnamed companies successfully breached by the threat actors have already paid ransoms, though Reuters was unable to definitively establish which specific firms capitulated to extortion demands.

The technique employed—known as social engineering—fundamentally exploits human psychology rather than technical vulnerabilities. Attackers manipulated individuals into voluntarily revealing confidential information by posing as internal IT support personnel, effectively circumventing traditional network security defenses. Google noted that despite the broad targeting campaign, many attempted intrusions failed to penetrate the security protocols maintained by target organizations, indicating that some firms successfully defended against the social engineering approach.

Austin Larsen, principal threat analyst at the Google Threat Intelligence Group, characterized the attackers' logic as straightforward financial calculation: "Really, it's a money thing. They think that these firms or organizations have data sensitive enough that, if taken, they would pay to prevent it." The deliberate targeting shift toward financial titans, law firms, and ratings agencies reflects attackers' strategic assessment that these entities manage substantial capital pools and control data sensitive enough to justify ransom payments.

The campaign underscores an emerging vulnerability in Wall Street's cybersecurity landscape: the shift from network-focused threats to identity and personnel-based compromise vectors. As technical security controls have strengthened, threat actors increasingly exploit the human element as the path of least resistance to access high-value financial institutions and their proprietary data.