Google's security researchers have identified multiple hacking groups — dubbed Falcon, Helix, Pink, and Redact, collectively tracked as UNC6671 — targeting large U.S. financial and investment firms including Apollo Global Management, Blackstone, and KKR. The attackers use voice phishing (vishing), calling employees on personal cellphones while impersonating IT staff or coworkers to steal credentials and MFA codes via spoofed websites. Stolen data is then used to extort victims with threats of public exposure, with ransom demands ranging from $750,000 to $3 million. One associated cryptocurrency wallet received around $10 million in bitcoin in recent months. The groups previously targeted manufacturing, healthcare, real estate, and tech sectors, but have shifted focus to legal and financial firms involved in mergers, acquisitions, and litigation to maximize leverage.
Questions this post answers
What hacking technique are the UNC6671 groups using to break into financial firms?
The UNC6671-linked groups use voice phishing (vishing) — calling employees on personal cellphones while impersonating coworkers or IT helpdesk staff, then tricking them into entering credentials and MFA codes on spoofed websites. Google tracks four subgroups under the names Falcon, Helix, Pink, and Redact, and believes they may share a common Phishing-as-a-Service infrastructure. Security teams defending financial organizations can track emerging vishing campaigns and threat actor TTPs on daily.dev.
How much are the UNC6671 hackers demanding in ransom from financial firm victims?
Ransom demands from the UNC6671-linked groups typically range from $750,000 to $3 million per victim. One cryptocurrency wallet associated with one of the groups received approximately $10 million in bitcoin within the first few months of the year, indicating significant extortion revenue across multiple targets. Incident responders and security leads navigating ransomware negotiations find relevant threat intelligence on daily.dev.