--- title: Google links UNC6671 extortion group to cyberattacks on... description: Google's Threat Intelligence Group (GTIG) has identified UNC6671, a cluster of hacking groups operating as Falcon, Helix, Pink, and Redact, behind a wave of... canonical: https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google links UNC6671 extortion group to cyberattacks on major financial firms | daily.dev og:description: Google's Threat Intelligence Group (GTIG) has identified UNC6671, a cluster of hacking groups operating as Falcon, Helix, Pink, and Redact, behind a wave of... og:url: https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e og:image: https://api.daily.dev/og/posts/OAh6AOS3e.png og:image:alt: Google links UNC6671 extortion group to cyberattacks on major financial firms og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google links UNC6671 extortion group to cyberattacks on major financial firms **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Google's Threat Intelligence Group (GTIG) has identified UNC6671, a cluster of hacking groups operating as Falcon, Helix, Pink, and Redact, behind a wave of extortion attacks on major U.S. financial firms including Apollo Global Management, Blackstone, KKR, and Citadel. The group uses voice phishing (vishing) to impersonate IT staff, directing employees to adversary-in-the-middle phishing sites to steal Microsoft 365 and Okta SSO credentials, MFA codes, and session cookies. Stolen data is leveraged for extortion demands up to $3 million, typically settling around $750,000. Between January and May 2026, over $10.6 million in Bitcoin payments were tracked to wallets linked to the group. UNC6671 is connected to the BlackFile extortion campaign and shares tactical similarities with Scattered Spider, though its infrastructure is distinct. ## Content ## What's happening A hacking group tracked by Google's Threat Intelligence Group (GTIG) as UNC6671 has been running a sustained extortion campaign against large U.S. financial firms. Targets include Apollo Global Management, Blackstone, KKR, Point72, Millennium Management, Two Sigma, and Citadel. Levi Strauss also disclosed a breach in an SEC filing that some outlets have linked to the same wave of attacks, though attribution hasn't been confirmed. Between January and May 2026, GTIG tracked over $10.6 million in Bitcoin flowing to wallets associated with the group. ## How the attacks work There's no software exploit here. Attackers call employees directly on their personal cellphones, impersonating IT support or coworkers, then direct them to spoofed login pages that harvest Microsoft 365 and Okta credentials alongside one-time MFA codes in real time. Once they're in, automated tools pull data from every connected cloud service. This is why MFA doesn't stop it. The phishing sites act as a relay, capturing the session cookie before the victim realizes anything is wrong. In the Levi Strauss case, attackers got into three employees' company-issued computers via social engineering. No consumer data was affected and operations continued normally, but corporate data was exfiltrated. ## The extortion side Stolen data gets used as leverage. Ransom demands start as high as $3 million and typically settle around $750,000, with threats to publicly expose the data if victims don't pay. The group has deliberately shifted focus toward legal and financial firms involved in mergers, acquisitions, and litigation — sectors where confidential data carries maximum leverage. ## Who's behind it UNC6671 operates under several brand names: Falcon, Helix, Pink, and Redact. GTIG links the group to the BlackFile extortion campaign. Mandiant, which is assisting several dozen compromised organizations, notes that UNC6671's infrastructure is distinct from Scattered Spider, despite some surface similarities in tactics. The group previously targeted manufacturing, healthcare, real estate, and tech before pivoting to financial services. ## Questions this post answers ### How does the UNC6671 extortion group carry out attacks on financial firms? UNC6671 uses voice phishing (vishing), calling employees on personal cellphones while impersonating IT help desk staff or coworkers. Victims are directed to adversary-in-the-middle phishing sites that steal Microsoft 365 and Okta SSO credentials, MFA codes, and session cookies. Once inside, automated tools exfiltrate data from all connected cloud services, which is then used as leverage for ransom demands up to $3 million, typically settling around $750,000. _Teams defending financial infrastructure track active threat actor TTPs like these on daily.dev._ ### How much has UNC6671 collected in ransom payments and over what period? Between January and May 2026, GTIG tracked over $10.6 million in Bitcoin payments to wallets associated with UNC6671. Initial ransom demands reach up to $3 million, but settlements typically land around $750,000. The group targets organizations holding sensitive deal information — particularly those involved in mergers, acquisitions, and litigation — where reputational risk increases leverage. _Security professionals monitoring ransomware payment trends and threat actor activity follow developments like this on daily.dev._ ## Similar posts on daily.dev - ['Several dozen' orgs targeted by a new extortion crew](https://daily.dev/posts/several-dozen-orgs-targeted-by-a-new-extortion-crew-hwkvov6ma) · The Register · 0 upvotes · 0 comments - [Google: New UNC6783 hackers steal corporate Zendesk support tickets](https://daily.dev/posts/google-new-unc6783-hackers-steal-corporate-zendesk-support-tickets-gepqft9l2) · BleepingComputer · 0 upvotes · 0 comments - [Ongoing Targeted Campaign Against US Law Firms](https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn) · Google Cloud · 0 upvotes · 0 comments - [North Korea's UNC1069 Hammers Crypto Firms With AI](https://daily.dev/posts/north-korea-s-unc1069-hammers-crypto-firms-with-ai-hmfmtwor5) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google links UNC6671 extortion group to cyberattacks on major financial firms","url":"https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e"},"datePublished":"2026-08-06T21:31:41.798Z","dateModified":"2026-08-10T20:46:04.093Z","description":"Google's Threat Intelligence Group (GTIG) has identified UNC6671, a cluster of hacking groups operating as Falcon, Helix, Pink, and Redact, behind a wave of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/38ba7c4959011b77c429fd046174fccc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/38ba7c4959011b77c429fd046174fccc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Google links UNC6671 extortion group to cyberattacks on major financial firms"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-links-unc6671-extortion-group-to-cyberattacks-on-major-financial-firms-oah6aos3e#faq","mainEntity":[{"@type":"Question","name":"How does the UNC6671 extortion group carry out attacks on financial firms?","acceptedAnswer":{"@type":"Answer","text":"UNC6671 uses voice phishing (vishing), calling employees on personal cellphones while impersonating IT help desk staff or coworkers. Victims are directed to adversary-in-the-middle phishing sites that steal Microsoft 365 and Okta SSO credentials, MFA codes, and session cookies. Once inside, automated tools exfiltrate data from all connected cloud services, which is then used as leverage for ransom demands up to $3 million, typically settling around $750,000. Teams defending financial infrastructure track active threat actor TTPs like these on daily.dev."}},{"@type":"Question","name":"How much has UNC6671 collected in ransom payments and over what period?","acceptedAnswer":{"@type":"Answer","text":"Between January and May 2026, GTIG tracked over $10.6 million in Bitcoin payments to wallets associated with UNC6671. Initial ransom demands reach up to $3 million, but settlements typically land around $750,000. The group targets organizations holding sensitive deal information — particularly those involved in mergers, acquisitions, and litigation — where reputational risk increases leverage. Security professionals monitoring ransomware payment trends and threat actor activity follow developments like this on daily.dev."}}]} ```