UNC6671 threat actor rebrands, targets financial services with vishing

UNC6671 primarily utilizes voice phishing (vishing) to target enterprise employees, posing as IT helpdesk staff for urgent security migrations. Victims are lured to spoofed login portals where Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication tokens, often contacted via personal mobile devices.

Following successful credential harvesting, UNC6671 deploys automated scripts to exfiltrate data from enterprise cloud environments, including Microsoft 365 and Okta. The group's operations leverage shared infrastructure and phishing templates across its various associated extortion brands.

UNC6671's targeting patterns have evolved, shifting towards organizations that are more likely to hold sensitive information. Recent activity shows a focus on financial services, private equity, and professional services, as well as technology, transportation, and hospitality organizations holding valuable intellectual property.

The UNC6671 threat actor group, previously associated with the BlackFile brand, has resurfaced under multiple new extortion brands including Redact, Pink, Helix, and Falcon. Despite an alleged retirement announcement for BlackFile, UNC6671 continues its operations, suggesting a rebranding rather than disbandment.

Analysis reveals that UNC6671 reuses generic root domains across multiple target organizations, linking the Falcon, Helix, and Pink extortion brands. This shared infrastructure and consistent phishing templates suggest a common group of threat actors operating these distinct brands.

The Redact operators published a statement claiming their rebrand from BlackFile was due to a compromised and hijacked brand by an exiled affiliate. They asserted this affiliate orchestrated the 'shutdown' to cause confusion and distance themselves from the alleged rogue operations.