Google says hackers are calling financial firm employees to hack and extort victims

Hackers are targeting large financial and investment firms in the United States to steal sensitive data for extortion. Specific targets include private equity firms such as Apollo Global Management, Blackstone, KKR, Moody’s, and TPG. The attackers use voice phishing, or vishing, by calling employees posing as coworkers or IT staff to trick them into revealing credentials and multi-factor codes on spoofed websites. Some hacking groups publish their stolen data online and threaten to leak it for ransom. Google researchers track these activities under the collective name UNC6671, suggesting a coordinated effort across different extortion brands. These threat actors have previously targeted sectors including manufacturing, real estate, healthcare, insurance, technology, transportation, and hospitality to steal intellectual property or client data.

The pattern observed is the commodification and professionalization of social engineering as an extortion mechanism, demonstrating a strategic shift from purely technical exploits to leveraging human interaction for maximum financial yield. The use of vishing, which relies on psychological pressure and impersonation, suggests that in the face of increasingly sophisticated automated defenses (like AI-powered attacks), the weakest link remains the human element, which is being weaponized through established social manipulation tactics. The concept of a coordinated umbrella like UNC6671 indicates an operational strategy focused not just on theft but on compartmentalization and managing negotiation fallout across multiple victims and branding. This suggests that criminal organizations are evolving into scalable service providers for high-value data extraction rather than ad-hoc attacks. The threat model is shifting from simple data exfiltration to complex, multi-stage extortion campaigns targeting specific high-leverage targets like M&A-involved financial entities, implying a strategy aimed at maximizing leverage by exploiting the unique vulnerabilities inherent in corporate structures and confidential deal flows. This points toward an ongoing challenge where technical security measures must be coupled with advanced social awareness training, as the success of these operations relies on exploiting predictable human responses under duress.