Skip to content
HACKTECH
Social engineeringReported Published 3 sources

Helpdesk vishing group UNC6671 turns to financial and legal firms, Google reports

Google Threat Intelligence Group (GTIG) reported on 6 August 2026 that UNC6671, a data theft extortion actor that previously operated under the BlackFile brand, had diversified across extortion brands including Redact, Pink, Helix and Falcon, while noting that splintered affiliates or shared phishing infrastructure could also explain the overlaps. Its callers pose as IT helpdesk staff, often ringing employees' personal mobile phones with an urgent passkey or MFA enrolment pretext, and send them to lookalike portals where adversary-in-the-middle infrastructure intercepts credentials and MFA tokens. GTIG said that by July 2026 targeting had narrowed to the financial and legal sectors, including private equity firms, law firms and financial rating agencies. BleepingComputer reported that the attribution followed Reuters and Bloomberg reports of vishing attacks on several hedge funds.

  • vishing
  • help desk
  • passkeys
  • AiTM phishing
  • MFA bypass
  • data extortion
  • Microsoft 365
  • Okta
  • UNC6671

What the sources report

  • GTIG reviewed 18 BlackFile Bitcoin wallets that received 141.65 BTC, approximately $10.69 million at the time of the transactions, between 7 January and 12 May 2026; payments continued after the brand's data leak site shutdown notice of 11 May 2026.
  • According to GTIG, initial demands typically ranged from $1 million to upwards of $3 million, operators often accepted reductions of 50% to 75%, and in over 53% of tracked cases final payments averaged $750,000.
  • Lure pages sat on victim-specific subdomains such as [company].createssopasskey[.]com and [company].addssopasskey[.]com; between 1 June and 31 July 2026 a new domain appeared roughly every 1.6 days, primarily on Cloudflare and DDOS-GUARD, compared with one every 2.2 days in April and May (GTIG).
  • After establishing session persistence, operators ran automated scripts to exfiltrate data from Microsoft 365 and Okta, and in recent intrusions deleted password-reset confirmations and alerts generated by changes to account security or MFA settings (GTIG); Mandiant said it was assisting several dozen organisations compromised by UNC6671 (BleepingComputer).
  • BleepingComputer cited Reuters and Bloomberg reports that Point72, Millennium, Two Sigma, Citadel and several private-equity firms were targeted; Point72 reportedly found no evidence client data was stolen and Two Sigma said it blocked an attempted intrusion. After publication, the Falcon group said it was exclusively a Redact affiliate and denied any connection to Helix, Pink or other groups named in Mandiant's reporting.
  • Arctic Wolf tracks activity sharing significant tradecraft similarities with UNC6671 as PREY-0058, most often aimed at directors, vice presidents and other executives; it said Exchange collection generated MailItemsAccessed events and SharePoint and OneDrive collection produced high volumes of FileAccessed and FileDownloaded events (Help Net Security).

What it means for your organisation

The weak point is identity proofing around MFA and passkey enrolment: a plausible call to a personal phone was enough to steer staff to an AiTM page that relayed their login and MFA, and the resulting session opened connected SaaS data in services such as Microsoft 365 and Okta. GTIG told BleepingComputer the methods share similarities with helpdesk social engineering historically associated with Scattered Spider, although it tracks this infrastructure and extortion network separately as UNC6671. Phishing-resistant MFA helps only if enrolment and recovery flows are equally hard to talk through, and if SaaS audit events are retained and monitored.

What we check

  • Run a consented vishing exercise using a passkey-migration pretext against staff and the service desk, including contact via personal mobiles, and check that identity is verified out of band before any MFA reset or factor enrolment.
  • Review Entra ID and Okta factor-registration policy: who can enrol passkeys or authenticators, from which devices and networks, and whether a registration following failed or abandoned push challenges raises an alert.
  • Test Conditional Access and session controls against AiTM token replay, including phishing-resistant MFA enforcement, sign-in frequency, Continuous Access Evaluation and challenges for residential-proxy or hosting-provider IP ranges.
  • Confirm Microsoft 365 and Okta audit logs capture and retain MailItemsAccessed, FileAccessed and factor-setup events long enough for incident responders to scope bulk SaaS exfiltration.
  • Monitor passive DNS and certificate transparency data for subdomains carrying the organisation's name on passkey-, SSO- or MFA-themed domains, which GTIG said UNC6671 used to host victim-specific lure pages.

Sources

Services that cover these checks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works