Loading threat actor…
UNC6671 is a financially motivated cybercrime and data-extortion cluster active since at least early 2026 and publicly associated with multiple extortion brands including BlackFile, Redact, Pink, Helix, and Falcon. The activity has also been tracked as CORDIAL SPIDER. Reporting consistently links these brands through overlapping infrastructure, shared phishing templates, common victimology, and a stable tradecraft pattern centered on help-desk impersonation and cloud-focused data theft. UNC6671 specializes in voice-phishing and related social-engineering operations against enterprise employees, frequently contacting targets on personal mobile phones while posing as internal IT help-desk staff. Common pretexts involve urgent security migrations, passkey enrollment, or multifactor-authentication updates. Victims are directed to attacker-controlled adversary-in-the-middle phishing portals designed to capture credentials, one-time passwords, and authenticated sessions in real time. The group has repeatedly targeted identity and SaaS platforms including Okta and Microsoft 365, then abused compromised single-sign-on access to reach connected cloud services such as email, file storage, CRM, and other enterprise applications. Post-compromise behavior includes session hijacking, automated cloud data exfiltration, password-reset abuse for non-SSO applications, and deletion of security notifications, password-reset confirmations, and MFA alerts from compromised inboxes to reduce detection. The actor has demonstrated rapid infrastructure provisioning and recovery, victim-specific phishing subdomains, and operational compartmentalization across callers, administrators, and extortion functions. In some campaigns, UNC6671 spoofed legitimate help-desk phone numbers and used tailored phishing infrastructure against organizations with MFA enabled but without phishing-resistant authentication. UNC6671’s targeting evolved during 2026 from broad enterprise sectors such as manufacturing, real estate, healthcare, and insurance toward higher-value organizations in technology, transportation, hospitality, financial services, private equity, legal services, and financial ratings. High-profile targeting has included hedge funds, private-equity firms, major law firms, and other organizations likely to hold sensitive information related to mergers and acquisitions, litigation, capital deployment, intellectual property, source code, and VIP client data. Activity has been observed against organizations in North America, the United Kingdom, and Australia. The group’s extortion model is primarily data-theft extortion rather than encryption-led ransomware. Victims are threatened with publication of stolen data on leak sites operated under its various brands, and reporting has tied the operation to substantial ransom revenue in 2026. UNC6671 is best understood as a cloud-focused, socially engineered extortion ecosystem that combines vishing, adversary-in-the-middle credential theft, session abuse, and large-scale SaaS data exfiltration to monetize access to high-value corporate information.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
97 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Activity cluster linked to Helix that shares infrastructure with multiple extortion brands and has been observed using vishing and device code phishing to gain initial access against cloud services and identity infrastructure.
A wider umbrella collective that Google says includes Helix.
Broader activity cluster linked to Helix and other extortion brands; operators use helpdesk-themed vishing, device code phishing, credential theft, and data theft from cloud services including Microsoft 365, and have also targeted Okta infrastructure.
Conducting a sustained vishing- and adversary-in-the-middle-driven credential theft and data extortion campaign against high-value organizations, especially firms using Okta and other SaaS platforms. The actor uses phishing infrastructure, real-time OTP/session relay, pivots into Microsoft 365 and Salesforce after successful authentication, exfiltrates data, deletes security warning emails, and sends extortion demands via TOX.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.