Google says hackers are calling financial firm employees to hack and extort victims

Even as the cybersecurity landscape grapples with the advent of AI-powered autonomous cyberattacks, a recent report from Google’s security researchers highlights the continued efficacy of crude, yet highly effective, tried-and-tested hacking techniques. Groups of unknown cybercriminals are leveraging social engineering, specifically voice phishing (vishing), to infiltrate major financial and investment firms across the United States. Their primary objective: to steal sensitive data and subsequently extort victims under the threat of public disclosure.

Google’s security researchers published their findings in a comprehensive report on Thursday, detailing the sophisticated yet old-fashioned methods employed by these groups. While Google’s report refrained from naming the targeted entities, subsequent reporting by Reuters identified several prominent victims. These include leading private equity firms such as Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG – a roster that underscores the high-value nature of the targets and the potential ramifications of these breaches.

The hacking groups, which Google has designated with the codenames Falcon, Helix, Pink, and Redact, have honed their craft in social engineering. Their modus operandi revolves around vishing, a technique that exploits human trust and vulnerability rather than technical exploits. Attackers initiate phone calls to employees’ personal cellphones, skillfully impersonating legitimate coworkers or IT helpdesk staff. During these calls, they meticulously craft scenarios designed to trick unsuspecting targets into divulging their login credentials and multi-factor authentication (MFA) codes. This sensitive information is then entered by the victim onto spoofed websites meticulously designed by the attackers to mimic legitimate corporate portals, thereby granting the hackers unauthorized access to corporate networks and data.

Voice phishing, a subset of social engineering, has proven remarkably persistent in the face of ever-evolving technological defenses. Its effectiveness lies in bypassing technological safeguards by manipulating human psychology. Attackers often employ psychological tactics such as creating a sense of urgency, fear, or obligation, making employees believe they are assisting a colleague or resolving a critical system issue. The use of personal cellphones further complicates detection, as these calls often bypass corporate network security monitoring. Once credentials and MFA codes are obtained, the attackers gain a critical foothold, enabling them to navigate internal systems, exfiltrate data, and prepare for their ultimate extortion demands.

Following a successful breach and data exfiltration, the cybercriminal groups transition to an aggressive extortion phase. Several of the groups identified by Google maintain dedicated websites where they openly publicize their successful hacks. These sites serve as platforms to threaten victims with the public leaking of their stolen data, a common and highly damaging tactic within the cybercrime ecosystem. The explicit goal is to compel the victim organizations to pay a substantial ransom to prevent the release of confidential information, which could lead to severe reputational damage, regulatory penalties, and loss of competitive advantage.

One such extortion site, quoted in Google’s report, explicitly outlines the groups’ negotiation stance: "We conduct every negotiation on professional terms. The publication of your data is never our preferred resolution; it is the consequence of refusal to engage, deliberate stalling, or failure to honor an agreement. Respond promptly and in good faith, and the matter is resolved without further incident." This professional, yet menacing, tone is designed to exert maximum pressure on victims, presenting cooperation as the only viable path to mitigating further harm.

Google’s researchers have posited that these distinct hacking groups—Falcon, Helix, Pink, and Redact—may not be entirely independent entities. Instead, they are believed to be operating as part of a larger, coordinated umbrella collective that Google tracks under the designation UNC6671. The exact nature of their relationship—whether they are affiliates, splinter groups, or merely utilizing a shared Phishing-as-a-Service (PhaaS) infrastructure—remains unclear. However, the consistent methodology and shared extortion tactics strongly suggest a common origin or operational framework.

The report elaborates on this hypothesis, stating: "We believe that this most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations, hide overall breach volumes, and isolate any negotiation fallout." This strategy allows the collective to distribute risk, potentially obfuscate the full scale of their activities, and manage negotiations more effectively by presenting different ‘faces’ to different victims, making it harder for law enforcement and cybersecurity firms to track the full scope of their operations.

The targeting of financial and investment firms represents a strategic evolution for these groups. Google indicates that the hacking collective has a history of targeting a broader spectrum of industries, including manufacturing, real estate, healthcare, and insurance sectors, as well as technology, transportation, and hospitality companies. In these previous campaigns, their objectives typically revolved around stealing "valuable intellectual property, software source code, or sensitive VIP client data." The shift towards legal and financial organizations, particularly private equity firms, underscores a deliberate strategy to maximize extortion leverage.

Google’s researchers explain this shift: "Concentrating on organizations involved in mergers, acquisitions, capital deployment, and litigation may reflect a strategy to target high-value corporate and confidential data to maximize leverage extortion demands." Data from private equity firms, for instance, could include unannounced merger and acquisition plans, proprietary investment strategies, sensitive client portfolios, or highly confidential financial details. Such information, if leaked, could cause immense market disruption, insider trading opportunities, and catastrophic financial and reputational damage to the affected firms and their clients, thereby increasing the likelihood of ransom payments.

The financial gains reaped by these cybercriminals are substantial. Google reported that a single cryptocurrency wallet associated with one of the hacking groups received approximately $10 million in Bitcoin within the first few months of the current year alone. The typical ransom demands imposed on victims range significantly, from $750,000 to $3 million, reflecting the high value placed on the stolen data and the perceived ability of the victim organizations to pay. These figures underscore the lucrative nature of data extortion and the considerable resources likely available to the UNC6671 collective for further operations and infrastructure development.

In the wake of these revelations, several of the reportedly targeted firms were contacted for comment. Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG did not respond to requests for comment, a common practice among organizations dealing with sensitive cybersecurity incidents to avoid further publicity or potential impact on ongoing investigations or negotiations.

The persistence of vishing as a successful attack vector, even amidst discussions of advanced AI-driven cyber threats, serves as a stark reminder of the fundamental importance of human vigilance in cybersecurity. Organizations must not only invest in robust technical defenses but also continuously educate their employees about social engineering tactics, the dangers of unsolicited calls, and the critical importance of verifying identities and requests through established, secure channels. The human element remains both the strongest and most vulnerable link in the cybersecurity chain, and threat actors like UNC6671 continue to exploit this reality with considerable success.