Threat ActorPublished 6 Aug 2026

Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group

Source Bleeping Computer

Description

A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile threat actors. [...]

Impact

The attacks enable unauthorized access to corporate cloud environments by stealing credentials and session cookies through vishing and phishing techniques. This access allows attackers to exfiltrate sensitive data from multiple cloud platforms and delete security notifications, increasing the risk of undetected data breaches and extortion. Financial organizations targeted include major hedge funds and private-equity firms, potentially exposing sensitive financial and client information. While some targeted firms have reported no evidence of data theft, the extortion group has successfully extracted millions in ransom payments from victims.

Defensive guidance

Organizations should be aware of the vishing tactics used by UNC6671, including help desk impersonation and enrollment in fake security updates. Strengthening employee awareness and training against vishing attacks is critical. Monitoring for suspicious domain registrations and phishing kits impersonating corporate domains may help detect attacks. Use of strong multi-factor authentication methods resistant to interception and session cookie theft is recommended. Since this is a cloud environment compromise, securing single-sign-on configurations and monitoring for anomalous access is advised. Vendor advisories or official guidance from affected service providers should be consulted for additional mitigations.

References

bleepingcomputer.com/news/security/hedge-fund-cyberattacks-tied-to-blackfile-linked-unc6671-extortion-group/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Aug 2026, 20:26 UTC

References

Community reviews