‘Retired’ Cybercrime Group Targets Major Financial Firms In Extortion Campaign
By CU Today Staff —
NEW YORK--A cybercrime group that claimed to have retired in May has instead rebranded and launched a wave of attacks against major financial and professional services firms, including Apollo Global Management, KKR and Moody’s, according to BankInfoSecurity.
BankInfoSecurity reported that Google threat researchers have linked the attacks to UNC6671, an extortion actor previously operating as BlackFile. Rather than shutting down, BlackFile appears to have resurfaced under names including Redact, Pink, Helix and Falcon. Other confirmed targets include Bain Capital, Blackstone, Bridgewater Associates, Clearlake Capital, CME Group and TPG.
The attacks rely heavily on social engineering, particularly voice phishing aimed at compromising corporate single sign-on accounts, BankInfoSecurity reported. Attackers pose as IT help-desk personnel and tell employees they must urgently update multifactor authentication or enable FIDO2 passkeys, directing them to lookalike websites designed to steal credentials and authentication tokens. In some cases, attackers call employees' personal phones while spoofing legitimate corporate help-desk numbers.
Once access is established, the attackers use automated scripts to exfiltrate information from enterprise cloud environments, including Microsoft 365 and Okta, according to BankInfoSecurity. Reuters-reviewed internet intelligence data indicated the attackers developed a roadmap targeting more than 200 companies during a five-week period, extending beyond financial services to companies including Uber, Zillow and Levi Strauss and law firms Paul Hastings and Greenberg Traurig.
The campaign could be highly lucrative. BankInfoSecurity reported Google identified 18 bitcoin wallets tied to BlackFile that received 141.65 bitcoins, worth approximately $11 million at the time of the transactions, between Jan. 7 and May 12. Google said ransom demands typically range from $1 million to more than $3 million, although negotiated payments are often lower. In more than 53% of tracked cases during the period, final payments averaged $750,000.
Originally reported by CU Today.