Google links UNC6671 extortion group to cyberattacks on major financial firms

UNC6671 uses voice phishing (vishing), calling employees on personal cellphones while impersonating IT help desk staff or coworkers. Victims are directed to adversary-in-the-middle phishing sites that steal Microsoft 365 and Okta SSO credentials, MFA codes, and session cookies. Once inside, automated tools exfiltrate data from all connected cloud services, which is then used as leverage for ransom demands up to $3 million, typically settling around $750,000. Teams defending financial infrastructure track active threat actor TTPs like these on daily.dev.

Between January and May 2026, GTIG tracked over $10.6 million in Bitcoin payments to wallets associated with UNC6671. Initial ransom demands reach up to $3 million, but settlements typically land around $750,000. The group targets organizations holding sensitive deal information — particularly those involved in mergers, acquisitions, and litigation — where reputational risk increases leverage. Security professionals monitoring ransomware payment trends and threat actor activity follow developments like this on daily.dev.