UNC6671 Vishing Campaign Targets Major Wall Street Financial Firms

In early August 2026, cybersecurity research published by Google’s Threat Intelligence Group (GTIG) revealed a alarming, large-scale cyber offensive hitting the foundational institutions of global finance. A highly coordinated threat group tracked as UNC6671 initiated a massive voice-phishing operation targeting over 200 high-value financial entities, including private equity behemoths, hedge funds, rating agencies, law firms, and exchange platforms. High-profile names caught in the crosshairs of the UNC6671 vishing campaign include Blackstone, Apollo Global Management, Bain Capital, KKR, Citadel, Point72, Bridgewater Associates, CME Group, and Moody’s. Rather than wasting zero-day exploits on hardened network perimeters, UNC6671 bypassed multi-million-dollar cybersecurity stacks by exploiting the human interface—specifically, enterprise identity controls.

The Escalation of Identity-Centric Cyberwarfare on Wall Street

The financial services sector has long maintained some of the most stringent digital perimeter defenses in the world. However, the UNC6671 vishing campaign illustrates a decisive paradigm shift toward identity-based exploitation. Threat actors recognize that penetrating network firewalls or overcoming Endpoint Detection and Response (EDR) software requires immense resources, whereas manipulating employees into relinquishing access provides direct, legitimate access to corporate cloud infrastructure.

Private equity firms, hedge funds, and market rating agencies are uniquely vulnerable to extortion because of the nature of the data they maintain. Confidentially held mergers and acquisitions (M&A) deal pipelines, proprietary trading algorithm methodologies, corporate valuation frameworks, and non-public transaction records represent invaluable assets. Threat actors understand that the unauthorized disclosure or public release of these records carries non-linear legal liability, regulatory sanctions, and irreparable reputational fallout. UNC6671 purposefully selected high-value targets where the mere threat of a data leak creates maximum negotiation leverage.

Furthermore, GTIG’s analysis uncovered that UNC6671 is not an isolated or single-branded operation. Originally emerging in early 2026 under the extortion moniker BlackFile, the threat group recently diversified its operational footprint. Today, associated operators utilize multiple distinct extortion brands—including REDACT, FALCON, HELIX, and PINK—to monetize stolen data, compartmentalize risk, hide total intrusion volumes, and isolate themselves from public negotiation failures.

Anatomy of the UNC6671 Vishing Campaign: Step-by-Step Attack Lifecycle

The threat actors executed a meticulous, multi-stage kill chain designed to systematically strip identity providers (IdPs) of their authentication controls. By deconstructing the campaign, security operations centers (SOCs) can understand how easily traditional multi-factor authentication (MFA) can be neutralized through social engineering.

Phase 1: Deep Reconnaissance and Targeted Outreach

UNC6671 began its attacks with extensive open-source intelligence (OSINT) gathering. Rather than dialing general corporate front desks or relying on corporate landlines, the attackers procured the direct personal mobile phone numbers of key employees across investment, risk analysis, and operational departments. This direct outreach established a sense of privacy and urgency, catching targets off-guard outside standard office channels.

Phase 2: Help Desk Pretexting and Urgency Creation

Operating over voice calls, the threat actors impersonated enterprise IT help desk representatives or service desk staff. Using tailored pretexts, the callers informed employees that their accounts required urgent action—often citing mandatory system maintenance, Single Sign-On (SSO) migrations, or required FIDO2/passkey security updates. Because the callers possessed accurate internal operational context (such as correct manager names or software vendor names), victims routinely accepted the impersonation as legitimate.

Phase 3: Adversary-in-the-Middle (AiTM) Infiltration

Instead of merely asking for credentials verbally, callers instructed employees to navigate to specially registered, lookalike domains (e.g., subdomains featuring themes like [company].createssopasskey[.]com). Behind these landing pages sat sophisticated Adversary-in-the-Middle (AiTM) proxy framework infrastructure. As the target entered their corporate username, password, and subsequent MFA challenge code (such as SMS passcodes or push notification responses), the AiTM proxy relayed these inputs to the real identity provider in real-time. This captured the authenticated enterprise session tokens directly from the victim.

Phase 4: Cloud Exploitation and Programmatic Data Theft

Equipped with live session tokens, UNC6671 bypassed perimeter controls entirely and logged in directly as the legitimate user. The actors navigated Single Sign-On platforms (such as Okta and Microsoft 365) and gained access to downstream SaaS applications, including Salesforce, Zendesk, SharePoint, and OneDrive environments. To maximize exfiltration speed and bypass manual browsing limitations, UNC6671 deployed automated Python and PowerShell scripts. These tools systematically swept document libraries for sensitive files while mimicking standard browser client network traffic to avoid triggering automated anomaly alarms.

Phase 5: Evasion and High-Pressure Extortion

To delay breach detection, attackers actively conducted post-compromise cleanup—frequently deleting automated password-reset confirmation emails and system alert logs within the victim’s inbox. Once high-value assets were secured, UNC6671 delivered initial ransom demands via unbranded consumer email accounts, directing executives to encrypted messaging platforms such as Tox or Session. Demands routinely spanned into millions of dollars. If victim leadership resisted or ignored outreach, the threat actor escalated tactics by delivering threatening voicemails and spamming personnel directly.

Why Legacy Defenses Fail Against Voice Phishing and AiTM Proxies

The success of the UNC6671 vishing campaign underscores a critical vulnerability in modern enterprise defense architecture: the reliance on legacy MFA mechanisms. While enabling multi-factor authentication was once considered the gold standard of identity security, traditional MFA variants—such as SMS codes, voice-based OTPs, and push notifications—are inherently susceptible to real-time proxy interception.

• Session Token Interception: AiTM proxies act as transparent relays between the victim and the legitimate login portal. When a victim inputs an SMS passcode or approves a push prompt, the proxy intercepts the resulting session cookie, allowing the attacker to assume the session without knowing the underlying password.
• Out-of-Band Blind Spots: Calling employees directly on personal mobile devices bypasses corporate endpoint monitoring and network firewalls completely. Security teams cannot inspect or flag malicious incoming phone calls arriving on personal hardware.
• Legitimate Traffic Emulation: Because the attackers utilize legitimate access tokens and programmatically request cloud data using standard web requests, Cloud Access Security Brokers (CASBs) and SOC monitoring solutions struggle to differentiate between malicious exfiltration and a busy analyst reviewing M&A files.

Mitigation Strategies: How Financial Enterprises Can Counter UNC6671

Defending against advanced voice-phishing and identity takeover operations requires moving beyond awareness training and legacy MFA. Enterprise security leaders must enforce technical controls that make identity harvesting mathematically impossible.

1. Enforce Phishing-Resistant MFA (FIDO2 / WebAuthn)

Financial institutions must aggressively migrate away from push notifications, TOTP apps, and SMS authentication in favor of FIDO2/WebAuthn hardware security keys (such as YubiKeys) or device-bound passkeys. FIDO2 standards bind authentication requests directly to the legitimate domain origin. If a user visits an AiTM phishing domain (e.g., [company].createssopasskey[.]com), the hardware security key detects the origin mismatch and refuses to provide the cryptographic assertion token, rendering the phishing site completely useless.

2. Implement Strict Out-of-Band Help Desk Verification Protocols

Organizations must establish mandatory verification workflows before any IT support representative can perform password resets, MFA device re-registrations, or account restorations:

1. Callback Protocols: Never allow help desk personnel to execute account modifications during an inbound or unverified call. Require callback procedures through verified corporate channels.
2. Manager Verification: Mandate live, secondary approval from a direct manager via verified enterprise video chat before granting credential resets.
3. Out-of-Band Shared Secrets: Utilize pre-enrolled cryptographic challenges or physical security team sign-offs for high-privilege access resets.

3. Deploy Identity Threat Detection and Response (ITDR)

Enterprise identity providers (Okta, Microsoft Entra ID) must be coupled with continuous Identity Threat Detection and Response (ITDR) tools. SOCs should configure automated alerts for:

• Improbable travel velocity or logins originating from unrecognized IP addresses immediately following an IT help desk interaction.
• Mass file downloads or automated script executions sweeping SharePoint and OneDrive repositories.
• New device enrollments or MFA method additions occurring from external, unmanaged network locations.

4. Restrict SaaS Access to Enrolled Managed Devices

In addition to strong authentication, enterprise administrators must enforce Conditional Access policies requiring device compliance. By restricting Microsoft 365, Okta, and SaaS suite access strictly to corporate-managed, compliant devices carrying valid client certificates, stolen session tokens acquired via personal devices become useless on unauthorized threat actor infrastructure.

Conclusion

The sweeping impact of the UNC6671 vishing campaign across Wall Street demonstrates that human-targeted social engineering remains the most potent attack vector against corporate enterprise networks. As cybercrime syndicates like UNC6671 refine their AiTM proxy capabilities and multi-brand extortion models, financial institutions can no longer rely on legacy authentication or basic perimeter security. Securing sensitive capital, proprietary valuation data, and strategic deal records now demands an absolute commitment to phishing-resistant FIDO2 hardware controls, strict help desk protocols, and zero-trust identity architectures.