Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group
Hedge funds and financial firms targeted by UNC6671 extortion group using vishing.
A new wave of cyberattacks targeting hedge funds and private-equity firms has been linked to the UNC6671 extortion group, previously known as BlackFile. The attackers use voice phishing (vishing) to trick employees into granting access to corporate systems, often targeting cloud environments and stealing credentials and session cookies. UNC6671 has diversified its operations across multiple brands, including Redact, Pink, Helix, and Falcon, and has been observed extorting millions of dollars from victims.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe UNC6671 extortion group exploits human trust rather than technical vulnerabilities, using voice phishing (vishing) to manipulate employees into voluntarily surrendering access to corporate systems, credentials, and session cookies. This attack highlights the critical weakness that even well-secured technical environments face when end users are not trained to recognize and resist social engineering. The targeting of cloud environments amplifies the blast radius, as compromised credentials can unlock vast amounts of sensitive financial data without requiring any malware or exploitation. The group's diversification across multiple brand identities (Redact, Pink, Helix, Falcon) makes attribution and blocking more difficult, underscoring why behavioral detection is more reliable than indicator-based defenses alone.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — BlackFile
- malware — UNC6671
- malware — Redact
- malware — Pink
- malware — Helix
- malware — Falcon