Key Takeaways
- • UNC6671 extortion group, linked to the former BlackFile ransomware operation, has orchestrated a coordinated wave of voice phishing (vishing) attacks targeting major hedge funds and private-equity firms, including Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel, Bain Capital, Blackstone, Bridgewater Associates, Clearlake Capital, CME Group, and TPG.
- • Diversified branding across multiple extortion personas — UNC6671 operates under multiple public brands including Redact, Pink, Helix, and Falcon, suggesting a single core intrusion group coordinating data theft and extortion operations across different fronts to complicate attribution and law enforcement response.
- • Voice phishing as primary attack vector — attackers impersonate IT support staff to deceive employees into granting unauthorized access to corporate systems and credentials, with some organizations devising dedicated phishing websites to harvest passwords from financial services employees.
- • Limited data breach confirmation — Point72 reported no evidence of client data theft despite the intrusion attempt; Two Sigma blocked the attack with no confirmed system or data compromise; other targeted firms have not disclosed material data loss, though investigation timelines remain ongoing.
- • BlackFile emergence and expansion timeline — the extortion group first appeared in February 2025 targeting retail and hospitality sectors before pivoting to high-value financial services targets, indicating a deliberate shift toward institutions with greater payment capacity and sensitive deal information.
Summary
A significant cybersecurity threat has emerged targeting the institutional investment industry. UNC6671, an extortion group operating under the former BlackFile brand, has conducted a coordinated campaign of voice phishing attacks against major hedge funds, private-equity firms, and related financial services organizations. According to Google's Threat Intelligence Group, the campaign has compromised operational security at Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel, along with prominent private-equity firms including Bain Capital, Blackstone, Bridgewater Associates, Clearlake Capital, and TPG. CME Group has also been identified as a confirmed target.
The attack methodology relies on social engineering rather than technical exploits. Threat actors impersonate helpdesk and IT support personnel to convince employees to divulge credentials or grant remote system access. In some cases, attackers constructed fraudulent login portals designed to harvest employee credentials from financial services firms. This approach bypasses many traditional security controls and exploits the trust relationships within organizations.
Austin Larsen, a principal threat analyst at Google's Threat Intelligence Group, confirmed that UNC6671 operates the attack campaign across multiple extortion brands, including Redact, Pink, Helix, and Falcon. This diversification suggests a single core intrusion group managing coordinated operations under different public personas, likely to fragment victim populations, complicate law enforcement attribution, and reduce the visibility of total operational scale. BlackFile itself first emerged in February 2025 as a data theft extortion operation targeting retail and hospitality sectors before expanding into high-value financial services.
Regarding data compromise, disclosed impacts have been limited. Point72 informed investors it had been successfully attacked but found no evidence of client data theft. Two Sigma reported blocking an intrusion attempt with no indication of system or data compromise. Other targeted organizations have declined to comment publicly or have not disclosed material data losses as of the reporting date. However, ongoing investigations may reveal additional compromises.
The shift from retail targeting to institutional finance indicates deliberate victim selection based on payment capacity and the value of proprietary deal information. For institutional investors and alternative asset managers, this campaign underscores vulnerabilities in human-centric security controls and the necessity of heightened voice authentication protocols, credential monitoring, and employee security awareness training focused on social engineering tactics.
The attack methodology relies on social engineering rather than technical exploits. Threat actors impersonate helpdesk and IT support personnel to convince employees to divulge credentials or grant remote system access. In some cases, attackers constructed fraudulent login portals designed to harvest employee credentials from financial services firms. This approach bypasses many traditional security controls and exploits the trust relationships within organizations.
Austin Larsen, a principal threat analyst at Google's Threat Intelligence Group, confirmed that UNC6671 operates the attack campaign across multiple extortion brands, including Redact, Pink, Helix, and Falcon. This diversification suggests a single core intrusion group managing coordinated operations under different public personas, likely to fragment victim populations, complicate law enforcement attribution, and reduce the visibility of total operational scale. BlackFile itself first emerged in February 2025 as a data theft extortion operation targeting retail and hospitality sectors before expanding into high-value financial services.
Regarding data compromise, disclosed impacts have been limited. Point72 informed investors it had been successfully attacked but found no evidence of client data theft. Two Sigma reported blocking an intrusion attempt with no indication of system or data compromise. Other targeted organizations have declined to comment publicly or have not disclosed material data losses as of the reporting date. However, ongoing investigations may reveal additional compromises.
The shift from retail targeting to institutional finance indicates deliberate victim selection based on payment capacity and the value of proprietary deal information. For institutional investors and alternative asset managers, this campaign underscores vulnerabilities in human-centric security controls and the necessity of heightened voice authentication protocols, credential monitoring, and employee security awareness training focused on social engineering tactics.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.