UNC6671 is an extortion group linked to the BlackFile campaign that targets hedge funds, private-equity firms, and financial organizations using voice phishing (vishing) attacks. Attackers impersonate corporate help desks to trick employees into enrolling in fake security updates, stealing credentials and session cookies via adversary-in-the-middle phishing kits hosted on spoofed domains. Compromised Microsoft 365 or Okta single-sign-on accounts provide access to multiple cloud platforms, from which data is stolen and security alerts deleted. The group operates multiple extortion brands and has shifted focus to financial and legal sectors since July 2026. The group has extorted over $10 million in Bitcoin, with initial ransom demands around $3 million often settling near $750,000. Mandiant and Google Threat Intelligence Group track UNC6671 separately from similar groups like Scattered Spider. Several dozen organizations are currently being assisted due to compromises by UNC6671.

The attacks enable unauthorized access to corporate cloud environments by stealing credentials and session cookies through vishing and phishing techniques. This access allows attackers to exfiltrate sensitive data from multiple cloud platforms and delete security notifications, increasing the risk of undetected data breaches and extortion. Financial organizations targeted include major hedge funds and private-equity firms, potentially exposing sensitive financial and client information. While some targeted firms have reported no evidence of data theft, the extortion group has successfully extracted millions in ransom payments from victims.

No official patch or fix applies as this is a social engineering and credential theft campaign. Organizations should be aware of the vishing tactics used by UNC6671, including help desk impersonation and enrollment in fake security updates. Strengthening employee awareness and training against vishing attacks is critical. Monitoring for suspicious domain registrations and phishing kits impersonating corporate domains may help detect attacks. Use of strong multi-factor authentication methods resistant to interception and session cookie theft is recommended. Since this is a cloud environment compromise, securing single-sign-on configurations and monitoring for anomalous access is advised. Vendor advisories or official guidance from affected service providers should be consulted for additional mitigations.