A recent wave of cyberattacks targeting hedge funds, private equity firms, and other financial organizations has been attributed to UNC6671, an extortion group that has previously operated under the name BlackFile. The attacks reportedly leveraged voice phishing (vishing) to gain unauthorized access to corporate systems.
Among the organizations reportedly targeted are Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel, along with several private equity firms. Point72 informed its investors that it had experienced an attack but found no evidence of client data theft. Two Sigma stated that it successfully blocked an attempted intrusion and found no indication of compromise to its systems or data. Millennium and Citadel declined to comment on the reports.
Google's Threat Intelligence Group (GTIG) tracks this vishing activity as UNC6671. According to GTIG, while UNC6671 previously operated under the "BlackFile" brand, it has since diversified its extortion operations across multiple public brands, including Redact, Pink, Helix, and Falcon. GTIG assesses that a single core intrusion group is responsible for the helpdesk vishing and cloud data theft associated with these various extortion brands.
BlackFile, a data theft extortion group, first appeared in February 2025, initially targeting retail and hospitality organizations. By July 2026, the group's focus shifted to private equity firms, hedge funds, major law firms, and financial-rating agencies, after previously targeting sectors such as manufacturing, healthcare, real estate, technology, transportation, and hospitality. In May 2026, BlackFile announced its rebranding to Redact on its data leak site.
Between January and May 2026, GTIG tracked over $10.6 million USD in Bitcoin payments to wallets associated with the group. Initial ransom demands reportedly reached upwards of $3 million, though operators frequently settled for around $750,000 USD after negotiations.
Following reports linking Falcon to UNC6671 and other brands, the Falcon extortion group issued a statement on its data leak site. Falcon claimed to be exclusively an affiliate of Redact and denied any affiliation, connection, or shared umbrella with Helix, Pink, or any other group mentioned in the reporting. They asserted that they share no operators, infrastructure, tooling, negotiation channels, or proceeds with any group other than Redact.
UNC6671 operators typically initiate contact with employees on their personal mobile phones, impersonating corporate helpdesks. They falsely claim that employees need to enroll in passkeys or update their multi-factor authentication settings. Victims are then directed to spoofed company domains hosting adversary-in-the-middle phishing kits designed to steal credentials and session cookies in real time.
After acquiring Microsoft 365 or Okta single sign-on (SSO) accounts, the attackers log into the SSO dashboard, gaining access to all linked cloud platforms. They then employ automated tools to exfiltrate data from all accessible cloud services and delete security notifications and password-reset emails from compromised inboxes.
While the helpdesk vishing and Adversary-in-the-Middle authentication interception tactics share similarities with methods historically used by Scattered Spider (UNC3944), GTIG tracks the specific infrastructure, domain registration patterns, and multi-brand extortion network involved in these attacks as UNC6671. Mandiant is reportedly assisting several dozen organizations that have been compromised by UNC6671.
