Google: Hackers Targeting Financial Employees in Phone Scams
Hack groups are calling finance firm employees to steal data and extort victims.
1Rising Cyber Threats in the Finance Sector
According to a report by Google, hacking groups named Falcon, Helix, Pink, and Redact are targeting major financial and investment firms in the U.S. These groups impersonate IT support staff by calling employees' personal cell phones. Victims are tricked into entering their credentials and multi-factor authentication codes on spoofed websites. This technique is known as 'voice phishing' or 'vishing' in cybersecurity terms.
2Targeted Major Firms
Google did not name the victims in its report, but Reuters revealed that prominent private equity firms like Apollo Global Management, Bain Capital, Blackstone, and Bridgewater Associates were attacked. These firms are attractive targets due to their high-value client data and sensitive financial information. The hacking groups use stolen data to demand ransoms and pressure victims into paying.
3Ransom Demands and Leak Threats
Some hacking groups threaten to publish stolen data to force victims into paying ransoms. One group's website states, 'We conduct every negotiation on professional terms. Data publication is never our preferred resolution.' Ransom amounts typically range from $750,000 to $3 million. A cryptocurrency wallet linked to one group received around $10 million in Bitcoin earlier this year.
4Cross-Industry Attacks
Google researchers noted that these hacking groups have previously targeted large companies in manufacturing, real estate, healthcare, and insurance sectors. Attacks on tech, transportation, and hospitality firms have also been recorded, with stolen data including valuable intellectual property, software source code, and VIP client information. Recently, legal and financial organizations have become primary targets.
5Focus on Mergers and Acquisitions
Google's report highlights that hacking groups specifically target companies involved in mergers, acquisitions, and capital deployment. This strategy aims to access high-value corporate and confidential data to maximize ransom leverage. Researchers emphasize that such data poses significant risks and strengthens the hackers' bargaining power.
6UNC6671: A Large-Scale Collective
Google suspects that different hacking groups may be part of a larger collective tracked as UNC6671. It remains unclear whether these groups share a 'Phishing-as-a-Service' infrastructure or operate independently. Google suggests this structure helps compartmentalize operations, hide breach volumes, and isolate negotiation outcomes.
7Effectiveness of Traditional Methods
The report underscores that even in the age of AI-powered cyberattacks, traditional methods like voice phishing remain effective. Simple techniques that exploit employee trust continue to succeed. Google recommends enhanced training for finance sector employees and stronger multi-factor authentication systems to counter these threats.
8Urgent Cybersecurity Measures
Google's report calls for an urgent review of cybersecurity measures in the finance sector, particularly for companies in merger and acquisition processes. Researchers advise increasing employee training and tightening security protocols. Industry-wide collaboration is essential to prevent such attacks and protect sensitive data.
Original article: TechCrunch — Google: Finans Çalışanlarını Hedef Alan Hack Grupları