--- title: Google says hackers are calling financial firm employees... description: Google's security researchers have identified multiple hacking groups — dubbed Falcon, Helix, Pink, and Redact, collectively tracked as UNC6671 — targeting... canonical: https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google says hackers are calling financial firm employees to hack and extort victims | daily.dev og:description: Google's security researchers have identified multiple hacking groups — dubbed Falcon, Helix, Pink, and Redact, collectively tracked as UNC6671 — targeting... og:url: https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo og:image: https://api.daily.dev/og/posts/kyNZrdSWO.png og:image:alt: Google says hackers are calling financial firm employees to hack and extort victims og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google says hackers are calling financial firm employees to hack and extort victims **[TechCrunch](https://daily.dev/sources/tc)** · 3 min read · 0 upvotes · 0 comments ## Summary Google's security researchers have identified multiple hacking groups — dubbed Falcon, Helix, Pink, and Redact, collectively tracked as UNC6671 — targeting large U.S. financial and investment firms including Apollo Global Management, Blackstone, and KKR. The attackers use voice phishing (vishing), calling employees on personal cellphones while impersonating IT staff or coworkers to steal credentials and MFA codes via spoofed websites. Stolen data is then used to extort victims with threats of public exposure, with ransom demands ranging from $750,000 to $3 million. One associated cryptocurrency wallet received around $10 million in bitcoin in recent months. The groups previously targeted manufacturing, healthcare, real estate, and tech sectors, but have shifted focus to legal and financial firms involved in mergers, acquisitions, and litigation to maximize leverage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What hacking technique are the UNC6671 groups using to break into financial firms? The UNC6671-linked groups use voice phishing (vishing) — calling employees on personal cellphones while impersonating coworkers or IT helpdesk staff, then tricking them into entering credentials and MFA codes on spoofed websites. Google tracks four subgroups under the names Falcon, Helix, Pink, and Redact, and believes they may share a common Phishing-as-a-Service infrastructure. _Security teams defending financial organizations can track emerging vishing campaigns and threat actor TTPs on daily.dev._ ### How much are the UNC6671 hackers demanding in ransom from financial firm victims? Ransom demands from the UNC6671-linked groups typically range from $750,000 to $3 million per victim. One cryptocurrency wallet associated with one of the groups received approximately $10 million in bitcoin within the first few months of the year, indicating significant extortion revenue across multiple targets. _Incident responders and security leads navigating ransomware negotiations find relevant threat intelligence on daily.dev._ ## Similar posts on daily.dev - ['Several dozen' orgs targeted by a new extortion crew](https://daily.dev/posts/several-dozen-orgs-targeted-by-a-new-extortion-crew-hwkvov6ma) · The Register · 0 upvotes · 0 comments - [New BlackFile extortion group linked to surge of vishing attacks](https://daily.dev/posts/new-blackfile-extortion-group-linked-to-surge-of-vishing-attacks-uhj38rvmj) · BleepingComputer · 0 upvotes · 0 comments - [Ongoing Targeted Campaign Against US Law Firms](https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn) · Google Cloud · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google says hackers are calling financial firm employees to hack and extort victims","url":"https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo"},"datePublished":"2026-08-06T19:43:08.746Z","dateModified":"2026-08-10T20:46:04.071Z","description":"Google's security researchers have identified multiple hacking groups — dubbed Falcon, Helix, Pink, and Redact, collectively tracked as UNC6671 — targeting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/38ba7c4959011b77c429fd046174fccc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/38ba7c4959011b77c429fd046174fccc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"Google says hackers are calling financial firm employees to hack and extort victims"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-says-hackers-are-calling-financial-firm-employees-to-hack-and-extort-victims-kynzrdswo#faq","mainEntity":[{"@type":"Question","name":"What hacking technique are the UNC6671 groups using to break into financial firms?","acceptedAnswer":{"@type":"Answer","text":"The UNC6671-linked groups use voice phishing (vishing) — calling employees on personal cellphones while impersonating coworkers or IT helpdesk staff, then tricking them into entering credentials and MFA codes on spoofed websites. Google tracks four subgroups under the names Falcon, Helix, Pink, and Redact, and believes they may share a common Phishing-as-a-Service infrastructure. Security teams defending financial organizations can track emerging vishing campaigns and threat actor TTPs on daily.dev."}},{"@type":"Question","name":"How much are the UNC6671 hackers demanding in ransom from financial firm victims?","acceptedAnswer":{"@type":"Answer","text":"Ransom demands from the UNC6671-linked groups typically range from $750,000 to $3 million per victim. One cryptocurrency wallet associated with one of the groups received approximately $10 million in bitcoin within the first few months of the year, indicating significant extortion revenue across multiple targets. Incident responders and security leads navigating ransomware negotiations find relevant threat intelligence on daily.dev."}}]} ```