Key Takeaways
- • UNC6671, an extortion group linked to the BlackFile campaign that emerged in February 2025, has conducted a wave of cyberattacks targeting hedge funds, private-equity firms, and other financial institutions using voice phishing (vishing) tactics to compromise employee credentials and gain system access.
- • Major targets include Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel, and several unnamed private-equity firms, with Point72 reporting the breach to investors while stating no evidence of client data theft was found, and Two Sigma confirming it blocked the intrusion attempt with no systems or data compromised.
- • Google's Threat Intelligence Group confirms that UNC6671 operates under multiple public extortion brands—including Redact, Pink, Helix, and Falcon—indicating a single core intrusion group diversifying its extortion operations across different identities to complicate attribution and expand ransom targeting capabilities.
- • The vishing methodology represents a shift toward social engineering rather than purely technical exploitation, leveraging human vulnerability to bypass technical controls and suggesting that institutional cybersecurity posture alone may be insufficient without employee awareness protocols.
Summary
A coordinated wave of cyberattacks targeting prominent hedge fund and private-equity operations has been attributed to UNC6671, an extortion group with documented ties to the BlackFile campaign. According to reporting from Reuters and Bloomberg, the breach attempts employed voice phishing (vishing)—a social engineering technique that manipulates employees into voluntarily granting attackers access to corporate systems—rather than relying solely on technical vulnerabilities. The targeted firms include institutional heavyweights Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel, along with several private-equity organizations.
Point72 notified investors of the attack but stated that forensic investigation had uncovered no evidence of client data exfiltration. Two Sigma similarly disclosed an attempted intrusion that it successfully blocked, with internal review indicating no compromise of systems or client information. Millennium Management and Citadel declined to comment on the incidents. The divergent disclosure approaches—ranging from proactive investor notification to no public comment—underscore the varying risk communication strategies employed across the institutional asset management sector in response to cybersecurity breaches.
Austin Larsen, principal threat analyst at Google's Threat Intelligence Group (GTIG), confirmed that the company tracks this activity under the UNC6671 designation. Critically, Larsen's analysis indicates that UNC6671 operates as a unified intrusion group operating under multiple public-facing extortion brands, including Redact, Pink, Helix, and Falcon, in addition to BlackFile. "GTIG assesses that a single core intrusion group is driving the helpdesk vishing and cloud data theft across these various public extortion brands," Larsen stated. This operational structure—using brand diversification as a camouflage mechanism—complicates victim attribution and potentially enables the group to segment ransom negotiations and exploit brand-specific reputational leverage with different victim pools.
BlackFile itself first emerged in February 2025 with attacks targeting retail and hospitality organizations, suggesting an evolution toward higher-value financial services targets. The shift from retail/hospitality to institutional asset management represents significant mission creep and reflects the profitability differential that extortion groups perceive in the financial services sector. The reliance on vishing rather than purely technical exploits indicates that institutional cybersecurity infrastructure, while robust, remains vulnerable to coordinated social engineering campaigns that target the human element of operational security.
Point72 notified investors of the attack but stated that forensic investigation had uncovered no evidence of client data exfiltration. Two Sigma similarly disclosed an attempted intrusion that it successfully blocked, with internal review indicating no compromise of systems or client information. Millennium Management and Citadel declined to comment on the incidents. The divergent disclosure approaches—ranging from proactive investor notification to no public comment—underscore the varying risk communication strategies employed across the institutional asset management sector in response to cybersecurity breaches.
Austin Larsen, principal threat analyst at Google's Threat Intelligence Group (GTIG), confirmed that the company tracks this activity under the UNC6671 designation. Critically, Larsen's analysis indicates that UNC6671 operates as a unified intrusion group operating under multiple public-facing extortion brands, including Redact, Pink, Helix, and Falcon, in addition to BlackFile. "GTIG assesses that a single core intrusion group is driving the helpdesk vishing and cloud data theft across these various public extortion brands," Larsen stated. This operational structure—using brand diversification as a camouflage mechanism—complicates victim attribution and potentially enables the group to segment ransom negotiations and exploit brand-specific reputational leverage with different victim pools.
BlackFile itself first emerged in February 2025 with attacks targeting retail and hospitality organizations, suggesting an evolution toward higher-value financial services targets. The shift from retail/hospitality to institutional asset management represents significant mission creep and reflects the profitability differential that extortion groups perceive in the financial services sector. The reliance on vishing rather than purely technical exploits indicates that institutional cybersecurity infrastructure, while robust, remains vulnerable to coordinated social engineering campaigns that target the human element of operational security.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.