Threat Intel
UNC6671 Continues Vishing Extortion Campaigns Across Multiple Brands Targeting Financial Services and Cloud Environments
UNC6671 has rebranded its extortion operations into Redact, Pink, Helix, and Falcon while maintaining a vishing‑based approach to steal credentials and MFA tokens. The group targets Microsoft 365 and Okta accounts in financial services, private equity, and professional services firms. Defenders should verify support calls, enforce MFA, and educate staff on spoofed login portals.
In the latest analysis, the threat group UNC6671 has not retired its BlackFile extortion brand as claimed in May 2026. Instead, the actors have split into several fronts—Redact, Pink, Helix, and Falcon—while continuing to use voice‑phishing (vishing) to impersonate IT helpdesk staff.
What happened
Attackers call employees on their personal mobile devices, claiming urgent security migrations. They direct users to spoofed login portals that harvest credentials and MFA tokens via an Adversary‑in‑the‑Middle (AiTM) panel.
Impact
- Compromise of Microsoft 365 and Okta accounts.
- Automated scripts exfiltrate data from cloud environments.
- Targets include financial services, private equity, and professional services firms.
What to do
- Verify any migration or support call by contacting the official IT helpdesk number.
- Implement MFA with push notifications or hardware tokens; block AiTM portals.
- Deploy endpoint detection that flags vishing‑related call patterns.
- Educate staff on recognizing spoofed login pages and the importance of reporting suspicious calls.
UNC6671’s consistent TTPs—vishing, AiTM credential harvesting, and SaaS data theft—demonstrate a focused, evolving campaign.
Related articles
UNC6671’s BlackFile Vishing Campaign Targets Microsoft 365 & Okta – Defenders’ Response
In early 2026, UNC6671 launched a vishing‑based extortion operation, leveraging adversary‑in‑the‑middle techniques to compromise SSO and bypass MFA on Microsoft 365 and Okta. The group uses Python and PowerShell scripts to exfiltrate data before demanding ransom. Defenders should monitor voice‑phishing indicators, enforce MFA, and scrutinize SSO logs for anomalous activity.
Read briefing
Canadian Threat Actor Pleads Guilty in Snowflake and AT&T Extortion Campaigns
A 26-year-old Canadian national has entered a guilty plea for computer fraud and extortion schemes targeting over 165 organizations via stolen Snowflake credentials. The actor also admitted to the massive exfiltration of AT&T call and text metadata. SecOps teams must review identity provider settings, enforce rigorous multi-factor authentication, and monitor for unauthorized cloud data access.
Read briefing
Singapore Delivery Scams: Three Fraudster Groups Exposed by Group‑IB
Group‑IB has identified three distinct fraudster collectives orchestrating delivery‑based scams targeting Singapore consumers and businesses. The groups exploit legitimate courier services to deliver counterfeit or tampered goods, often as part of larger phishing or ransomware campaigns. Defenders should monitor shipment logs, verify sender authenticity, and educate staff on red‑flag indicators.
Read briefing
Defending Against Cross-Environment Pivots in Modern Enterprise Security Operations
Recent threat intelligence highlights a significant operational challenge for SecOps teams: adversaries are routinely pivoting across multiple enterprise environments to evade detection. According to recent incident response data, nearly half of all attacks span four or more attack surfaces, exploiting visibility gaps in siloed security tooling. Defenders must unify telemetry across cloud, endpoint, network, identity, and SaaS domains to successfully reconstruct complex attack paths.
Read briefing