UNC6671

Summary

Financially motivated data-theft extortion actor tracked by Google Threat Intelligence Group / Mandiant. Other vendors track overlapping, not identical, clusters: Cordial Spider (CrowdStrike), CL-CRI-1116 (Unit 42, moderate confidence) and PREY-0058 (Arctic Wolf); secondary reporting also maps O-UNC-045 (originating vendor not confirmed). It runs a rotating set of public extortion brands — BlackFile (announced shut down May 2026), REDACT from June 2026, plus FALCON (CL-CRI-1182), HELIX and PINK — linked through shared phishing infrastructure and templates rather than any claimed affiliation. No nation-state nexus is asserted. GTIG explicitly distinguishes it from Scattered Spider / UNC3944: the social engineering is similar, the infrastructure and domain-registration patterns are distinct. The chain is voice phishing — an operator posing as IT help desk calls the target on a personal mobile, spoofing the help-desk number, with an urgent FIDO2 passkey or MFA enrolment pretext. Victims land on lookalike passkey/SSO portals where a reverse-proxy adversary-in-the-middle panel captures credentials and the MFA token; September 2026 reporting adds device-code flow abuse and enrolment of attacker-controlled MFA methods for persistence. Post-compromise is programmatic bulk exfiltration from Microsoft 365 and Okta via Graph, SharePoint, OneDrive and Exchange REST APIs, followed by deletion of security alerts, MFA notifications and password-reset confirmations. Initial access is sometimes brokered by separate clusters tracked as Storm-3121 and Storm-3032. GTIG tracked 141.65 BTC (~USD 10.69M) across 18 BlackFile wallets between January and May 2026; initial demands of USD 1–3M settle around USD 750k. Sector focus rotated through 2026 from manufacturing, real estate, healthcare and insurance toward financial services, and by August 2026 to hedge funds and asset managers — reporting names Point72, Millennium Management, Two Sigma and Citadel among those affected.

Attribution

Runs several extortion brands as one group (GTIG)

Criminal or hacktivist group; no state sponsorship established.

• Google Threat Intelligence Group (Research, 2026-05-15)
  Financially motivated; independent of ShinyHunters
• Palo Alto Networks Unit 42 (Research, 2026-05-27)
  Financially motivated extortion; CL-CRI-1116 overlaps BlackFile

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 15

Malware and tools 1

Infrastructure patterns

• Passkey/SSO lookalike panels on generic root domains reused across targets (GTIG, 2026)
• AiTM panel domains hosted on Cloudflare, Private Layer, MEVSPACE and DDOS-GUARD (GTIG, 2026)
• Sign-ins through residential proxies on AT&T, Comcast, Starry and Optimum ranges (GTIG, 2026)
• Shared templates and bridge domains (e.g. passkeydeploy[.]com) tie BlackFile, Redact, Falcon, Helix and Pink (GTIG, 2026)

Reporting and advisories 4

• Google / Mandiant
  UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
• Google / Mandiant
  Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft
• BleepingComputer
  Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group (6 Aug 2026)
• Microsoft Security
  Passkey-themed M365 phishing