Key Takeaways
- • Cybercriminals tracked as UNC6671 have systematically targeted private equity firms and Wall Street financial organizations using voice phishing attacks, shifting focus from broader enterprise sectors including manufacturing, healthcare, and technology.
- • Despite public claims that the extortion operation BlackFile shut down in May 2026, infrastructure and telemetry analysis reveals the actors continued operations under multiple overlapping brands—Redact, Pink, Helix, and Falcon—each maintaining separate leak sites and negotiation channels while sharing consistent attack methodologies.
- • Attackers impersonate internal IT helpdesk personnel via calls to employees' personal mobile numbers, often spoofing legitimate helpdesk numbers, directing victims to fraudulent login pages designed to capture credentials and multi-factor authentication tokens in real time.
- • Once access is obtained, operators establish persistent sessions and deploy automated scripts to extract data from cloud platforms including Microsoft 365 and Okta environments, then systematically delete security alerts and confirmation messages to avoid detection.
- • Confirmed targets include major financial institutions such as Blackstone, KKR, Apollo, CME Group, and Moody's, with the attacks representing a significant evolution in threat actor targeting preferences toward high-value financial institutions.
Summary
Cybercriminals organized under the threat cluster UNC6671 have mounted a coordinated campaign targeting private equity firms and major Wall Street financial organizations using sophisticated voice phishing tactics. According to Google's threat intelligence researchers, the attackers have shifted their operational focus away from broader enterprise sectors toward higher-value targets in the financial services industry, including Blackstone, KKR, Apollo, CME Group, and Moody's.
The campaign centers on carefully orchestrated phone calls directed at employees' personal mobile numbers. Attackers pose as internal IT helpdesk personnel and create artificial urgency by claiming mandatory security updates are required—specifically citing the need to enable passkeys or revise multi-factor authentication settings. In many instances, the callers employ number spoofing techniques to mimic legitimate helpdesk contact numbers, enhancing perceived credibility. Once trust is established, victims are directed to convincing but fraudulent login pages engineered to capture credentials and authentication tokens through real-time interception techniques.
A critical aspect of this operation is its structural persistence despite public claims of shutdown. Although an associated extortion operation known as BlackFile announced closure in May 2026, analysis of infrastructure and telemetry data reveals the threat actors continued operations under multiple overlapping brands including Redact, Pink, Helix, and Falcon. These entities maintain separate public-facing leak sites and independent negotiation channels while employing consistent methodologies for initial access and data extraction.
Upon successful credential compromise, operators establish persistent sessions and deploy automated scripts to systematically extract data from cloud platforms, particularly Microsoft 365 and Okta environments. To minimize detection risk, attackers delete confirmation messages, security alerts, and other notifications that might alert legitimate account holders to unauthorized access. This layered approach—combining social engineering sophistication with technical evasion—represents a marked evolution in threat actor capabilities and demonstrates increasing focus on high-value institutional targets within the financial sector.
The campaign centers on carefully orchestrated phone calls directed at employees' personal mobile numbers. Attackers pose as internal IT helpdesk personnel and create artificial urgency by claiming mandatory security updates are required—specifically citing the need to enable passkeys or revise multi-factor authentication settings. In many instances, the callers employ number spoofing techniques to mimic legitimate helpdesk contact numbers, enhancing perceived credibility. Once trust is established, victims are directed to convincing but fraudulent login pages engineered to capture credentials and authentication tokens through real-time interception techniques.
A critical aspect of this operation is its structural persistence despite public claims of shutdown. Although an associated extortion operation known as BlackFile announced closure in May 2026, analysis of infrastructure and telemetry data reveals the threat actors continued operations under multiple overlapping brands including Redact, Pink, Helix, and Falcon. These entities maintain separate public-facing leak sites and independent negotiation channels while employing consistent methodologies for initial access and data extraction.
Upon successful credential compromise, operators establish persistent sessions and deploy automated scripts to systematically extract data from cloud platforms, particularly Microsoft 365 and Okta environments. To minimize detection risk, attackers delete confirmation messages, security alerts, and other notifications that might alert legitimate account holders to unauthorized access. This layered approach—combining social engineering sophistication with technical evasion—represents a marked evolution in threat actor capabilities and demonstrates increasing focus on high-value institutional targets within the financial sector.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.