Key Takeaways
- • Google security researchers identified a coordinated campaign by four hacking groups—Falcon, Helix, Pink, and Redact—collectively tracked as UNC6671, using voice phishing to breach major US financial institutions rather than deploying sophisticated malware.
- • Confirmed targets span the institutional investment landscape: Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody's, and TPG, with additional hedge funds including Two Sigma Investments, Citadel, and Point72 reportedly targeted.
- • Ransom demands typically range from $750,000 to $3 million per victim, with cryptocurrency wallets associated with the campaign receiving approximately $10 million in bitcoin during 2026 to date.
- • Voice phishing (vishing)—impersonating IT support via phone calls—exploits human error and employee trust in voice communication as a lower-risk vector than email, making it particularly effective against corporate security protocols.
- • The campaign underscores systemic vulnerability across the financial services sector, where 77% of financial organizations detected cyberattacks in the past 12 months compared to 68% among other industries.
Summary
A wave of coordinated cyberattacks targeting US investment giants is exploiting a deceptively simple social-engineering technique: phone calls impersonating IT support. According to Google's security research published in August 2026, hackers have successfully breached some of the largest private equity and asset management firms in the country by leveraging voice phishing—or "vishing"—rather than relying on sophisticated malware or zero-day exploits.
Google's threat intelligence team identified four distinct hacking groups—Falcon, Helix, Pink, and Redact—operating under the collective designation UNC6671. The campaign's methodology centers on human vulnerability: attackers contact employees posing as IT support personnel, building credibility through technical-sounding language, and ultimately gaining access to corporate networks and sensitive data. The apparent effectiveness of this low-tech vector reflects a critical gap in endpoint security awareness, particularly given that employees often perceive voice communication as inherently safer than suspicious emails or unsolicited digital requests.
The victim roster includes marquee names across institutional finance: Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, and Moody's have been confirmed as targets, along with hedge fund operators Two Sigma Investments, Citadel, and Point72. These organizations collectively manage trillions of dollars in assets, making them high-value targets for extortion-motivated threat actors. Ransom demands have ranged from $750,000 to $3 million per victim, with cryptocurrency wallets linked to the campaign receiving approximately $10 million in bitcoin this year alone.
The campaign reflects a broader vulnerability within the financial services sector: 77% of financial organizations detected cyberattacks over the past 12 months, compared to 68% among other industries. For institutional investors and asset managers, the incident underscores the necessity of enhanced voice-based authentication protocols, employee security training focused on social engineering vectors, and network segmentation designed to limit lateral movement once initial compromise occurs. The use of extortion alongside data theft compounds institutional and reputational risk, particularly for firms handling sensitive client information and proprietary investment strategies.
Google's threat intelligence team identified four distinct hacking groups—Falcon, Helix, Pink, and Redact—operating under the collective designation UNC6671. The campaign's methodology centers on human vulnerability: attackers contact employees posing as IT support personnel, building credibility through technical-sounding language, and ultimately gaining access to corporate networks and sensitive data. The apparent effectiveness of this low-tech vector reflects a critical gap in endpoint security awareness, particularly given that employees often perceive voice communication as inherently safer than suspicious emails or unsolicited digital requests.
The victim roster includes marquee names across institutional finance: Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, and Moody's have been confirmed as targets, along with hedge fund operators Two Sigma Investments, Citadel, and Point72. These organizations collectively manage trillions of dollars in assets, making them high-value targets for extortion-motivated threat actors. Ransom demands have ranged from $750,000 to $3 million per victim, with cryptocurrency wallets linked to the campaign receiving approximately $10 million in bitcoin this year alone.
The campaign reflects a broader vulnerability within the financial services sector: 77% of financial organizations detected cyberattacks over the past 12 months, compared to 68% among other industries. For institutional investors and asset managers, the incident underscores the necessity of enhanced voice-based authentication protocols, employee security training focused on social engineering vectors, and network segmentation designed to limit lateral movement once initial compromise occurs. The use of extortion alongside data theft compounds institutional and reputational risk, particularly for firms handling sensitive client information and proprietary investment strategies.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.