Loading story…
Major Wall Street firms, hedge funds, and private-equity organizations were targeted in a recent wave of attempted cyberattacks that used phone-based social engineering to gain access to corporate systems. Reported targets included Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel; Point72 said it found no evidence that client data was stolen, while Two Sigma said it blocked an attempted intrusion with no sign of impact. Reuters and Bloomberg also reported that several private-equity firms were targeted in the same campaign.
Researchers attributed the activity to UNC6671, an extortion group previously associated with the public brand BlackFile and now linked to brands including Redact, Pink, Helix, and Falcon. According to Google Threat Intelligence Group and Mandiant, the attackers used help-desk voice phishing to persuade employees to change passkeys or MFA settings, then redirected victims to adversary-in-the-middle phishing pages that captured Microsoft 365 or Okta credentials and session cookies. Investigators said the group shifted in July toward hedge funds, private-equity firms, major law firms, and financial-rating agencies, and tracked more than $10.6 million in Bitcoin payments to wallets tied to the operation between January and May 2026.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Reuters reported that financially motivated attackers used vishing calls and 72 phishing sites impersonating corporate IT help desks to target more than 200 companies over the prior five weeks. Named targets spanned private equity, hedge funds, exchanges, ratings firms, law firms, and other major companies including Blackstone, KKR, CME Group, Moody’s, Citadel, Uber, Zillow, Levi Strauss, Paul Hastings, and Greenberg Traurig.
Mandiant reported that in July 2026 the group shifted its targeting toward private-equity firms, hedge funds, major law firms, and financial-rating agencies.
Google Threat Intelligence Group said it tracked more than $10.6 million in Bitcoin payments to wallets linked to UNC6671, illustrating the scale of the group's extortion activity.
Google reported that BlackFile conducted a wave of attacks against retail and hospitality organizations after emerging in February 2025.
Google said the group later tracked as UNC6671 first emerged publicly under the BlackFile brand as a data-theft extortion operation.
Google Threat Intelligence Group linked the recent wave of attacks on hedge funds, private-equity firms, and other financial organizations to UNC6671, a group it says previously operated as BlackFile and now uses multiple extortion brands.
Two Sigma Investments said it blocked an attempted intrusion and found no indication that its systems or data were affected.
Point72 Asset Management told investors it had faced an attack and said it found no evidence that client or customer information was stolen.
In recent days, hackers attempted a series of sophisticated intrusions against major Wall Street financial firms and money managers using phone-based social engineering to gain access or elicit sensitive information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcebleepingcomputer.com
Open sourceteiss.co.uk
Open sourcebloomberg.com
Open sourcereuters.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group reported that **UNC6671** remains active after the apparent retirement of the **BlackFile** brand, with extortion operations now appearing under the **Redact**, **Pink**, **Helix**, and **Falcon** names. Investigators linked the brands through shared phishing infrastructure, overlapping victimology, and matching credential-harvesting templates, while noting the activity could also reflect splintered affiliates or shared phishing services. The group has increasingly targeted **financial services**, **private equity**, **law firms**, and other enterprises likely to hold highly sensitive corporate data. The actor uses helpdesk-themed **voice phishing** to contact employees, often on personal mobile phones, and directs them to adversary-in-the-middle phishing portals designed to steal credentials and **MFA** tokens for persistent access to **Microsoft 365**, **Okta**, and other SaaS environments. Google also observed a faster pace of domain registrations in June and July 2026 and new evasion tactics, including deleting password-reset and security-alert emails from compromised accounts. Separately, the report attributed **141.65 BTC** in BlackFile-linked ransom payments across **18 wallets** between January and May 2026.
Aug 17, 2026
**BlackFile**, a financially motivated extortion group likely tied to **The Com** and overlapping with activity tracked by CrowdStrike as **Cordial Spider**, has targeted retail and hospitality organizations with voice-phishing campaigns that impersonate corporate IT help desks. Researchers at Palo Alto Networks Unit 42 and RH-ISAC said the group has been active since at least February 2026, using spoofed phone numbers and fake corporate single sign-on pages to trick employees into surrendering credentials and one-time passcodes. After gaining access, the attackers register their own devices to bypass MFA, escalate privileges into administrative and executive accounts, and steal data from platforms including **Salesforce** and **SharePoint** through legitimate API and download functions. The stolen information is moved to attacker-controlled infrastructure, posted on a dark web leak site, and used to support **seven-figure ransom demands** sent from compromised employee accounts or Gmail; in some cases, the group has also used **swatting** against employees and executives to intensify pressure on victims.
Jun 29, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026