Fake IT Support Used in Cyber Attacks Targeting Financial Firms
Hackers targeted employees to extort millions in ransom payments.
1Attack Scope
The UNC6671 hacking group targeted over 200 financial companies including Blackstone, Bridgewater, and Apollo. By setting up fake IT support lines, the attackers stole employees' multi-factor authentication (MFA) credentials. According to Google's Threat Intelligence Group report, the hackers called corporate employees on their personal phones, claiming urgent security updates were required. Some companies reportedly paid ransoms, though their identities remain undisclosed.
2Attack Methods
The hackers spoofed legitimate IT support numbers to direct employees to fake websites. Victims were tricked into updating passwords, thereby compromising their credentials. Attackers captured second-factor authentication codes live during phone calls. After gaining access, they used automated tools to steal data from cloud services like Microsoft 365 and Okta. They also deleted security alerts and password reset notifications to hide their activity.
3Target Selection
The attackers selected companies most likely to pay ransoms to prevent sensitive data leaks. Private equity firms, law practices, and financial institutions were specifically targeted. UNC6671 shifted focus from large enterprises to higher-value targets. Google's report indicates the hackers typically demanded $1-3 million in ransom but negotiated 50-75% discounts. In over half of tracked cases, victims paid an average of $750,000.
4Bitcoin Payments
GTIG tracked 18 Bitcoin wallets linked to BlackFile between January-May 2026, which received 141.65 BTC (approximately $10.69 million). Payments continued even after the group announced the shutdown of its data leak site. Significant cash-out events in late April and early May confirmed financial operations continued uninterrupted during the rebranding phase.
5Company Responses
Reuters analyzed 72 malicious websites listed in Google's report to identify victim companies. Uber, Zillow, Levi Strauss, and law firms like Paul Hastings were among targets. Point72 Asset Management confirmed being targeted, while Greenberg Traurig stated its security protocols prevented a breach. Most companies declined comment or didn't respond.
6Hacker Group Connections
Groups operating under names like Redact, Pink, Falcon, and Helix are believed to share infrastructure. Redact explicitly stated on its darknet site it has no political or moral motivations. Falcon acknowledged ties with Redact but denied connections to Helix or Pink. Investigators haven't yet clarified the exact relationships between these groups.
7Sector Shifts
The campaign continuously evolved its strategy by shifting between sectors. It focused on targets where data had sufficient value for extortion—from private equity to law firms and financial rating agencies. The attackers calculated payment potential to guide their sectoral shifts, demonstrating operational flexibility that enabled prolonged activity.
8Sector Risks
These attacks reveal cybersecurity vulnerabilities in finance and employee susceptibility to social engineering. IT support teams must strengthen verification processes while employee training needs enhancement. Continued ransom payments may embolden hackers, increasing similar attacks. Developing collective defense mechanisms is critically important for the industry.
Original article: Security Affairs — Sahte IT Destek Hattıyla Finans Şirketlerine Siber Saldırı