Major US financial firms, including Blackstone, KKR, Apollo Global Management, Bridgewater Associates, Bain Capital, TPG, and CME Group, have been targeted by a sophisticated cyberattack campaign using fake IT support calls and fraudulent websites to steal employee credentials and authentication codes.
According to data from Google and internet intelligence reviewed by Reuters, the campaign was orchestrated by a threat actor tracked as UNC6671, linked to extortion brands such as Redact, Pink, Helix, and Falcon. Google’s Threat Intelligence Group (GTIG) is monitoring the activity, noting that the group continues to compromise organizations despite the reported shutdown of its earlier BlackFile operation.
Voice Phishing Tactics
Attackers employed voice phishing, or vishing, to contact employees while posing as company IT helpdesk staff. They created a sense of urgency around security-related tasks, such as updating authentication methods or enabling passkeys. Employees were then directed to websites designed to mimic legitimate company login and authentication pages, which were used to harvest passwords and other credentials.
Google reported that the attackers also used adversary-in-the-middle techniques to intercept authentication sessions and MFA tokens, further compromising security.
Targeted Firms and Scope
The identified targets include Blackstone, Apollo Global Management, Bridgewater Associates, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s. Other businesses and professional services firms were also targeted. However, being targeted does not necessarily mean a breach was successful; the attackers created infrastructure and attempted to compromise organizations, with varying outcomes.
Google’s analysis revealed that UNC6671’s focus shifted during 2026. Earlier activity involved manufacturing, real estate, healthcare, and insurance. By July, the group increasingly targeted financial and legal organizations, including private equity firms, law firms, and financial ratings agencies.
Potential Impact and Extortion
After obtaining credentials, attackers can attempt to access corporate cloud services such as Microsoft 365 and Okta. The broader objective is to steal data and extort victims. Google’s analysis of cryptocurrency wallets linked to the earlier BlackFile operation found that 18 Bitcoin addresses received a combined 141.65 BTC, worth approximately $10.69 million at the time. Initial ransom demands typically ranged from $1 million to over $3 million, though negotiations often resulted in lower payments.
This campaign underscores the risks of social engineering, where convincing phone calls and fake login pages bypass security measures by targeting employees directly. Organizations must remain vigilant and educate staff on recognizing such tactics.
Leave a Reply