UNC6671: How a vishing cartel stole $10M+ from Wall Street with fake IT helpdesk calls

A single cybercrime collective, tracked by Google's Threat Intelligence Group (GTIG) as UNC6671, has collected more than $10 million in Bitcoin since January 2026 by calling employees at major U.S. financial firms, impersonating IT helpdesk staff, and tricking them into handing over credentials — including live multi-factor authentication (MFA) codes . The operation, which originally ran under the BlackFile extortion brand before rebranding in mid-2026, now operates at least four public-facing extortion brands: Redact, Pink, Helix, and Falcon .

Confirmed target firms

Google's reporting and corroborating cybersecurity news outlets explicitly name the following large U.S. financial and investment firms as targets of UNC6671: Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody's, and TPG .

Reuters and Bloomberg additionally reported that Point72 Asset Management, Millennium Management, Two Sigma, and Citadel were also targeted .

How the attacks work

The attack chain relies on a deceptively simple combination of social engineering and adversary-in-the-middle (AiTM) phishing infrastructure, not sophisticated malware.

1. Vishing calls to personal cellphones. Attackers call employees on their personal mobile devices, spoofing caller IDs to appear as the company helpdesk. They claim an urgent passkey migration or MFA update is required . Targeting personal phones helps bypass corporate telephony monitoring and security tooling.

2. Real-time credential and MFA theft. Victims are directed to spoofed single sign-on portals that look identical to legitimate company pages. The AiTM proxy intercepts the username and password, then captures the live MFA token — whether push, SMS, or TOTP — in real time. The attacker immediately registers a new attacker-controlled MFA device to maintain persistent access .

3. Automated data exfiltration. Once inside, the group deploys automated Python and PowerShell scripts that harvest data from connected cloud services — Microsoft 365, SharePoint, OneDrive, Okta, Zendesk, and Salesforce. The scripts search for keywords like "confidential" and "SSN" to prioritize high-value data .

4. Extortion and data leak sites. Stolen data — including intellectual property, source code, and sensitive client information — is published on dedicated data leak sites (DLS) under each brand unless the victim pays the ransom .

Ransom demands and Bitcoin payouts

• Initial ransom demands reportedly range from $750,000 to $3 million per victim .
• In one case, a victim paid approximately $10.6 million in Bitcoin to the group over five months in early 2026 .
• Google's GTIG directly confirmed that the group collected more than $10 million in ransom payments since January 2026 .
• GTIG tracked 141.65 Bitcoin across 18 wallets linked to the earlier BlackFile operation .

Prior sector targeting

Before shifting focus to financial services, private equity, and professional services in mid-2026, UNC6671 (operating as BlackFile) targeted a wide range of sectors including manufacturing, real estate, healthcare, insurance, technology, transportation, and hospitality .

Attribution confidence and caveats

Google attributes all four extortion brands to the broader UNC6671 collective based on shared domain registration patterns, overlapping phishing templates, shared AiTM phishing kits, and overlapping victim organizations .

However, Google notes that alternative scenarios — such as splintered affiliates or multiple groups sharing the same Phishing-as-a-Service infrastructure — "may also be plausible" . The brands are not necessarily separate criminal crews; they are likely the same operator(s) running multiple leak-site brands simultaneously after rebranding from BlackFile.

Defensive recommendations

Security experts and Google's GTIG recommend the following mitigations against this specific threat :

• Require phishing-resistant MFA. FIDO2/WebAuthn passkeys are bound to the legitimate origin domain, which an AiTM proxy cannot forge regardless of how convincing the lookalike URL appears.
• Educate employees on vishing. Staff should be told that IT helpdesk will never call personal phones and demand immediate credential updates, especially in a high-pressure context.
• Establish out-of-band verification. Any unsolicited helpdesk request should be verified via a known corporate communication channel before action is taken.
• Monitor for anomalous session behavior. Security teams should watch for new MFA device enrollments, unusual login geolocations, and bulk data downloads from SharePoint and OneDrive.