[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOLdnJSspms0BS4necX4kdEdfOwXWwpQh56g1puFI3XM":3},{"article":4,"iocs":57,"watch_terms":71,"solutions":72,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"81dcfdd6-3463-4249-a33a-1b2eb2561571","Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group","hedge-fund-cyberattacks-tied-to-blackfile-linked-unc6671-extortion-group-cc3545","A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile campaign extortion group. [...]","A new wave of cyberattacks targeting hedge funds and private-equity firms has been linked to the UNC6671 extortion group, previously known as BlackFile. The attackers use voice phishing (vishing) to trick employees into granting access to corporate systems, often targeting cloud environments and stealing credentials and session cookies. UNC6671 has diversified its operations across multiple brands, including Redact, Pink, Helix, and Falcon, and has been observed extorting millions of dollars from victims.","Hedge funds and financial firms targeted by UNC6671 extortion group using vishing.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhedge-fund-cyberattacks-tied-to-blackfile-linked-unc6671-extortion-group\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F17\u002Fmoney-laundering-hackers.jpg","2026-08-06T20:07:24+00:00","2026-08-06T22:00:21.575119+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"UNC6671","threat_actor",{"name":21,"type":22},"BlackFile","campaign",{"name":24,"type":25},"Google","vendor",{"name":27,"type":28},"Microsoft 365","product",{"name":30,"type":28},"Okta","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[58,60,62,65,67,69],{"type":56,"value":21,"context":59},"Extortion group previously operating under this public brand.",{"type":56,"value":18,"context":61},"Current tracking name for the extortion group.",{"type":56,"value":63,"context":64},"Redact","Public brand used by UNC6671.",{"type":56,"value":66,"context":64},"Pink",{"type":56,"value":68,"context":64},"Helix",{"type":56,"value":70,"context":64},"Falcon",[24,27,30],{"controls":73,"vendors":157},[74,102,131],{"slug":75,"name":76,"problem":77,"products":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[79,86,94],{"vendor_slug":80,"vendor_name":30,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":103,"name":104,"problem":105,"products":106},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":132,"name":133,"problem":134,"products":135},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[136,144,150],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":145,"product_name":146,"url":148,"description":149},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":151,"product_name":154,"url":155,"description":156},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[158],{"slug":159,"name":24,"logo_path":160,"roles":161},"google","\u002Fvendor-logos\u002Fgoogle.png",[162],"reported_by",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":181},"vishing-attacks-on-hedge-funds-social-engineering-leads-to-credential-theft","Vishing Attacks on Hedge Funds: Social Engineering Leads to Credential Theft","The UNC6671 extortion group exploits human trust rather than technical vulnerabilities, using voice phishing (vishing) to manipulate employees into voluntarily surrendering access to corporate systems, credentials, and session cookies. This attack highlights the critical weakness that even well-secured technical environments face when end users are not trained to recognize and resist social engineering. The targeting of cloud environments amplifies the blast radius, as compromised credentials can unlock vast amounts of sensitive financial data without requiring any malware or exploitation. The group's diversification across multiple brand identities (Redact, Pink, Helix, Falcon) makes attribution and blocking more difficult, underscoring why behavioral detection is more reliable than indicator-based defenses alone.",[168,169,170,171,172,173,174,175,176,177,178,179,180],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-4 (System Monitoring)","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","MITRE ATT&CK T1566.004 – Phishing: Voice Phishing (Vishing)","MITRE ATT&CK T1539 – Steal Web Session Cookie","GDPR Article 32 – Security of Processing","ITIL – Service Operation: Access Management",{}]