A single core intrusion crew operating behind at least four extortion brands has spent 2026 phoning employees at hedge funds, private equity firms, and professional services companies, posing as their IT help desk and walking them through fake "security migrations" that hand over passwords and live MFA codes. Google Threat Intelligence Group (GTIG) published its assessment on August 6, 2026, tracking the activity as UNC6671 and linking the Redact, Pink, Helix, and Falcon extortion brands to the retired BlackFile operation. Google itself named no victims. Reuters and Bloomberg reporting, relayed by Security Affairs, TechCrunch, and BleepingComputer, put Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody's, TPG, Clearlake Capital, Point72, Millennium Management, Two Sigma, and Citadel on the target list. Victim counts differ sharply across sources and are worth reading carefully: Security Affairs frames the campaign as targeting "over 200 firms," while GTIG's own May 2026 reporting described "dozens" of organizations across North America, Australia, and the UK, and the August update quantifies no total at all. Treat 200-plus as press framing, not a vendor-confirmed number.
What Happened
GTIG's core finding is that BlackFile did not shut down. The brand announced its retirement in May 2026, and in June the operators stood up a new data leak site under the Redact name, publishing a post on June 27 claiming the original BlackFile brand had been hijacked by an exiled affiliate who ran a lookalike leak site, used unlinked Tox identities, and orchestrated the supposed shutdown. GTIG's telemetry and infrastructure analysis tells a different story: overlaps in phishing templates, victimology, and shared infrastructure conduits tie BlackFile, Redact, Pink, Helix, and Falcon to the same operators.
Austin Larsen, a principal threat analyst at GTIG, told BleepingComputer that "a single core intrusion group is driving the helpdesk vishing and cloud data theft across these various public extortion brands." GTIG's public assessment is that the multi-brand structure "most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations, hide overall breach volumes and isolate any negotiation fallout." Google is explicit that this is an assessment, not a proof: it names splintered affiliates and shared phishing-as-a-service infrastructure as plausible alternative explanations, and TechCrunch notes it remains unclear whether the brands are affiliates, splinters, or something else.
Accounts also differ on the group's origin. BleepingComputer dates BlackFile's emergence to February 2025, tied to a wave of attacks on retail and hospitality targets. SecurityWeek says the actor emerged in early 2026 under the BlackFile name. Both are OUTLET-tier and the primary GTIG post excerpted here does not settle it.
Targeting shifted in July 2026 toward private equity, financial services, and professional services, per Mandiant's reporting as summarized by BleepingComputer. Victim responses vary. Point72 reportedly told investors it had been attacked but found no evidence client data was stolen. Two Sigma said it blocked an attempted intrusion with no indication its systems or data were affected. Millennium and Citadel declined to comment to BleepingComputer, with Citadel pointing to Bloomberg's reporting.
Separately, Levi Strauss & Co. disclosed in an SEC filing that an attacker social-engineered three employees and exfiltrated corporate data from company-issued machines. BleepingComputer reports that some media outlets have linked that incident to UNC6671, but could not identify any threat actor claiming the attack, and no leak-site claim has surfaced. That link is unconfirmed.
What Was Taken
There is no record count in this incident, and no source provides one. What GTIG describes is bulk data theft from enterprise cloud tenants: once the attackers establish session persistence using stolen credentials and intercepted MFA tokens, they deploy automated scripts to exfiltrate data from Microsoft 365 and Okta environments. The stolen material is then used as extortion leverage, published or threatened for publication on brand-specific leak sites.
The sensitivity is a function of who was hit. Private equity firms, hedge funds, ratings agencies, and exchange operators hold deal documents, investor and LP correspondence, position data, and pre-public transaction material. That is data whose value comes from being non-public, which makes threatened publication unusually coercive compared with a commodity PII dump.
On payments, Security Affairs reports that some companies paid ransoms but that none of the payers have been identified. SecurityWeek's reporting characterizes the operation as having made millions across its rebrands. No source in this set gives a dollar figure or a count of paying victims.
For Levi's, the company's own SEC filing is the strongest evidence available: it believes certain corporate information was accessed and exfiltrated, that its response contained and terminated the unauthorized access, that no consumer data was impacted, and that there was no operational disruption or expected material financial impact. That investigation remains ongoing.
Why It Matters
This campaign is a direct refutation of the idea that MFA rollout closes the phishing problem. Every victim here presumably had multi-factor authentication deployed. The attackers did not break it; they asked for it, in real time, over the phone, and used it before it expired.
Three things make UNC6671 a harder defensive problem than a typical phishing crew. First, the attack channel bypasses corporate controls entirely: calls go to employees' personal mobile numbers, where no email gateway, no EDR, and no corporate telephony policy applies. Second, GTIG reports the actors have begun spoofing the organization's legitimate help desk number, which defeats the most common piece of user guidance ("check the number before you trust the caller"). Third, the compartmentalization strategy has an intelligence effect defenders should internalize: if one crew runs four leak sites, then every public breach tally derived from leak-site counting understates the real volume, and each victim negotiating with "Falcon" has no way to know they are talking to the same people who breached their peer under a different name.
The sector concentration matters too. A crew that has learned the vocabulary, tooling, and escalation rituals of one private equity firm's IT organization can reuse that pretext against the next twenty. The financial services focus is not opportunistic; it is a pretext economy of scale.
The Attack Technique
The chain is consistent across every brand, and consistency is itself part of GTIG's attribution basis.
- Vishing to a personal device. The caller reaches the target on a personal mobile number, posing as internal IT help desk staff or, per TechCrunch, sometimes as a co-worker. In at least some recent cases the legitimate help desk number is spoofed to add legitimacy.
- Urgency pretext. The stated reason is a mandatory, urgent security migration. PYMNTS, quoting the GTIG post, describes the specific pretext as an urgent help desk mandate to enable FIDO2 passkeys or update MFA enrollment. The irony is deliberate: the lure is a security improvement.
- AiTM credential harvesting. The victim is directed to a spoofed login portal backed by adversary-in-the-middle infrastructure that relays the session to the real identity provider, capturing the password and the second-factor token as they are entered. Security Affairs describes the operator harvesting the passcode live over the phone and hijacking the account before the call ends.
- Session persistence. With a valid session established, the attackers hold access independent of the original credential, which survives a routine password change.
- Automated cloud exfiltration. Scripts pull data from Microsoft 365 and Okta tenants at speed.
- Anti-forensics. Security Affairs reports the attackers delete security alerts and password reset notifications from compromised accounts, so the employee who took the call sees nothing unusual afterward.
- Extortion. Leak sites under the relevant brand carry the negotiation posture. One site quoted by TechCrunch reads: "We conduct every negotiation on professional terms. The publication of your data is never our preferred resolution; it is the consequence of refusal to engage, deliberate stalling, or failure to honor an agreement."
One note on source hygiene: the PYMNTS write-up quotes GTIG as saying "UNC6771 callers," which appears to be a transcription error for UNC6671. Security Affairs quotes the same passage with the correct designation.
What Organizations Should Do
- Move to phishing-resistant MFA and finish the job. FIDO2 security keys and platform passkeys bound to the origin do not relay through an AiTM proxy. Push notifications, TOTP codes, and SMS all do. Note that this crew uses passkey enrollment as its cover story, so the enrollment workflow itself needs to be locked down and communicated in advance.
- Kill the phone as an identity channel. Establish and enforce a rule that IT will never call an employee on a personal mobile number to walk them through an MFA or password change, and that no legitimate request will ever be made under time pressure. Give staff a single verification path, such as an internal ticket reference confirmed through a channel they initiate. Caller ID is not evidence; the attackers spoof it.
- Harden the help desk against the inverse attack. The same pretext runs in reverse against your own support staff. Require identity proofing that cannot be satisfied with data from a LinkedIn profile before any MFA reset, device enrollment, or number change.
- Monitor for session and enrollment anomalies, not just failed logins. Alert on new MFA method registration, impossible-travel or novel-ASN session token use, and OAuth or app-password grants in Microsoft 365 and Okta. Shorten session lifetimes and enforce token revocation on any credential reset.
- Watch for mailbox and log tampering. Because the actors delete alerts and reset notifications from compromised accounts, ship identity and mailbox audit logs off-tenant where the attacker cannot reach them, and alert on inbox rules or bulk deletions touching security notification senders.
- Rate-limit and alert on bulk cloud data access. The exfiltration stage is scripted. Anomalous volumes of SharePoint, OneDrive, or Okta API reads from a single session are the last reliable detection point before data leaves.
- Plan the extortion phase now. Assume the negotiating brand may not be the brand you eventually see on the leak site, and that a peer firm may be facing the same operators under a different name. Sector information sharing is worth more than usual here.
Sources: Hackers Impersonate IT Support to Breach Leading Financial Companies | UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets ... | Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion... | Google says hackers are calling financial firm employees to hack an... | Vishing Extortion Group UNC6671 Rebrands After Making Millions | Google Links Redact Extortion Group to BlackFile Rebrand - Infosecu... | Levi Strauss & Co. says hackers stole corporate data in cyberattack | PYMNTS Hackers Spoof Helpdesk Numbers to Steal Enterprise Cloud Data