The call does not reach the company switchboard. It reaches the employee's personal mobile, mid-afternoon, on the way home. On the other end, a calm voice claims to be from the IT service desk and needs five minutes to complete a “security migration” that is, it insists, mandatory and urgent.
The group behind those calls, tracked by Google Threat Intelligence Group as UNC6671, took in roughly 141.65 bitcoin — around 10.69 million dollars at the period's exchange rate — between 7 January and 12 May 2026, according to GTIG's analysis of eighteen wallets. It encrypts nothing: it steals data and threatens to publish it, then runs the negotiation under four different brand names.
The striking part is not the technique. Vishing and second-factor token theft are nothing new. What stands out is how the operation is organised: a single crew that presents itself as four separate groups and makes first contact well outside any corporate control. This is extortion run as a business, and it pays to see it that way before mounting a defence.
Who is UNC6671, and why does it run four brands?
The group surfaced in early 2026 under the name BlackFile. In May it retired that brand and, in June, launched a leak site under the name Redact, with a statement claiming the earlier operation “had been hijacked by an affiliate”. That is the group's own claim, not a verified fact: it is part of the usual script these actors use to muddy the trail.
What GTIG argues, and outlets such as SecurityWeek and Infosecurity Magazine have reported, is that the Redact, Pink, Helix and Falcon brands share enough infrastructure and digital footprint to attribute them to the same operators. Splitting activity across several brands serves three purposes: monetising separately, compartmentalising negotiations with each victim and, above all, frustrating tracking. A threat-intelligence team that blocks “Pink” may take weeks to realise “Falcon” is the same people.
How does the attack work, step by step?
First contact lands on the personal phone
The attacker calls the employee's personal mobile posing as the IT service desk, as GTIG describes in its report and The Hacker News corroborates. The choice of channel is deliberate: a private phone sits outside corporate email, outside the anti-phishing gateway and outside the EDR — none of those layers can see a voice call to a number the organisation does not even know. The pretext is usually a mandatory, time-boxed migration, the sense of urgency that pushes people to skip the usual steps.
The fake portal and the adversary in the middle
The call steers the victim to a cloned sign-in portal. Behind it sits adversary-in-the-middle (AiTM) infrastructure, a proxy positioned between the user and the legitimate service. When the employee enters their credentials and approves MFA, the proxy does not merely capture the password: it keeps the already-validated session token and replays it. This is the point many teams overlook — a push or SMS second factor does not stop a real-time relay, because the user approves a request they believe is their own.
After access: exfiltration and extortion
With a valid session inside the victim's cloud or SaaS estate — email, storage, CRM — the group locates and pulls out the sensitive data, then demands payment to keep it private. It is the same abuse-of-legitimate-access logic seen in the Salesforce data theft through OAuth, and it fits what we already knew about Microsoft 365 account takeover via AiTM. The harm does not depend on encrypting machines: proving they hold the data is enough. Unlike deepfake CEO fraud, which chases a single transfer, what is hijacked here is access itself: the session and the data behind it.
Why don't the usual controls catch it?
The first reason is the perimeter. The attack begins on a device the organisation neither manages nor observes, and by the time there is visible activity in corporate systems, the attacker is already logging in with a session that looks like the real employee's. Email and endpoint tools, built to stop attachments and links, arrive late to an attack that begins as a conversation.
The second is identity. A stolen session token is, as far as the system is concerned, the legitimate user: same sign-in, same permissions. Without controls that tie the session to a known device or location, there is no anomaly to trip. The underlying numbers point the same way: Mandiant's M-Trends 2026 ranks vishing as the second most observed initial access vector in 2025 (11% of cases, and the first — 23% — in cloud incidents), and IBM's X-Force Threat Intelligence Index 2026 places identity at the centre of the year's incidents.
There is a third, too: attribution. While threat intelligence ties indicators to “Redact”, the same crew is paid under “Helix” and prepares the next campaign as “Falcon”. Splitting the brand degrades the value of block lists and of reports that arrive under a single name.
What behavioural signals give the attack away?
Because the first move is invisible, detection is won by what happens next, in the identity layer. These signals are worth watching and, crucially, correlating rather than treating in isolation:
The registration of a new device or a new MFA method shortly after a “support” interaction is the most direct signal: it is the step the attacker needs to consolidate access. Alongside it, the use of a session token from a network, autonomous system or geography that does not match the employee's pattern — what is usually called impossible travel — points to a hijacked session.
From there, alert on bulk or unusual access to data repositories, consent granted to unfamiliar OAuth applications and new mail-forwarding rules, three classic moves in the exfiltration phase. And a low-cost check that is rarely automated: reconcile service-desk tickets against genuine internal requests, because a “migration” nobody asked for is, on its own, an indicator. A threat hunting and threat intelligence capability helps turn these signals into detections that hold up over time.
How does a financial firm defend itself?
The financial sector sits at the centre of this campaign for a simple reason: it holds very valuable data and works under a time pressure that favours the extortionist. Funds, asset managers, law firms and rating agencies combine both. The defence rests on several fronts that reinforce one another.
On identity, one of the highest-impact steps is phishing-resistant second factors — passkeys or FIDO2 — the only kind an AiTM proxy cannot reproduce. Do it with eyes open: when attackers hijacked passkey enrolment over the phone, we saw that the key's own enrolment can be manipulated, so the registration process needs out-of-band verification. To that factor add conditional access policies and session-to-device binding, so a stolen token is useless from an unknown machine.
On process, the weak point is the service desk. Resetting an MFA or authorising a “migration” must require out-of-band identity verification, over a channel the employee already has configured, and staff should internalise one plain rule: the organisation does not phone the personal mobile to ask for credentials. That message, once internalised, cuts off the very pretext the attack relies on. You prepare for these cases before they happen, with an incident response plan that covers the compromised-account scenario and immediate session revocation.
On governance, this kind of incident falls squarely within DORA for financial entities: operational resilience, control of third-party and ICT-provider risk, and reporting deadlines that start running from detection. Hardening the Microsoft 365 environment, where much of the data the group is after ends up, is the other half of the job: reviewing connected applications, mail rules and access posture.
What this case reveals
The lesson of UNC6671 lies not in a specific vulnerability but in how identity extortion has been industrialised. A single group that disguises itself as four, that phones a device the company does not control and that needs to encrypt nothing to do damage, describes an adversary that treats extortion as a business, with the operational discipline that implies.
One honest uncertainty remains: attribution across brands rests on infrastructure overlaps and may evolve as the investigation advances. What does not change is the direction of the defensive effort. As long as the second factor is an approval a user can grant over the phone, the voice call stays viable as a way in; phishing-resistant factors are what take it off the table.
This article analyses an active campaign using public information available at the date of publication. Attributions across extortion brands rest on infrastructure overlaps and may evolve; no mention implies a security flaw in the products cited, as the vector described is the abuse of legitimate access and social engineering. The detection and defence recommendations are general in nature and should be adapted to each environment.
