UNC6671 Rebrands and Targets Hedge Funds: Vishing MFA Bypass Hits Finance Firms in August 2026

UNC6671 is Google's internal tracking designation for the criminal vishing cluster that emerged in early 2025 under the public brand BlackFile. The group is Russian-speaking based on linguistic indicators in negotiation communications and infrastructure hosted across Switzerland, Poland, and Russia. No confirmed attribution to a state sponsor exists -- Google and Mandiant assess UNC6671 as purely financially motivated.

BlackFile operated from approximately February 2025 through May 11, 2026, targeting retail, hospitality, healthcare, and insurance organizations with vishing-based extortion. On May 11, 2026, the group announced a false shutdown, citing a "hijacking by exiled affiliates" as cover for a planned rebrand. Bitcoin payments to confirmed BlackFile wallets continued past the shutdown date.

The rebrand produced four simultaneous extortion fronts. REDACT and Pink share Tucows-registered domain infrastructure. Helix and Falcon overlap on Swiss VPS nodes at AS51852 Private Layer INC. Google's GTIG confirmed the links through shared domain registration patterns, identical AiTM proxy configurations, Bitcoin wallet reuse, and near-identical vishing scripts across all four brands.

The affiliate model gives UNC6671 structural resilience. Operators build the AiTM infrastructure and vishing playbooks; affiliates conduct the calls and splits vary by brand. This compartmentalization means law enforcement action against one affiliate does not expose the core infrastructure operators.

For a comparison with the BlackFile extortion group's retail targeting campaign that preceded this financial sector pivot, see the full April 2026 breakdown with retail-specific IOCs and Salesforce API theft TTPs.

UNC6671 attacks follow a seven-step chain that exploits human trust rather than software vulnerabilities. No patch closes this attack surface.

Step one is reconnaissance. Operators map target organizations on LinkedIn, identifying employees in IT support, identity management, helpdesk, and IT administration roles by title and recent activity. Victim-branded phishing portals are registered within hours of target selection using the company's name in predictable patterns: companyname-sso.com, companyname-passkey.com, or support-companyname.com.

Step two is the call. The operator contacts the target employee on their personal mobile phone -- not corporate-controlled endpoints, which would log the call. The caller spoofs the legitimate corporate helpdesk number so caller ID shows a familiar identity. The pretext has evolved: current campaigns claim an urgent FIDO2 passkey enrollment deadline or a required MFA security upgrade, framing noncompliance as a policy violation.

Step three is the redirect. The victim is directed to an AiTM phishing portal. The portal replicates the organization's actual SSO login page and relays every credential the victim enters to the legitimate Microsoft 365 or Okta authentication service in real time.

Step four is token theft. When the victim completes MFA -- entering a TOTP code, approving a push notification, or entering an SMS code -- the proxy intercepts the authenticated session cookie Microsoft or Okta returns. The victim is redirected to a plausible "enrollment complete" page. The attacker now holds a live, MFA-verified session.

Steps five through seven involve automated exfiltration via python-requests and PowerShell scripts targeting SharePoint, email, and connected SaaS applications, followed by deletion of MFA registration alerts and password reset notifications from the compromised inbox. The victim typically discovers the breach only when the extortion demand arrives.

This attack chain mirrors the STAC4749 vishing methodology documented in Microsoft Teams-based attacks, applied here to direct phone calls rather than collaboration platform messages.

UNC6671's sector targeting follows a deliberate value hierarchy. Retail and hospitality organizations targeted in 2025 yielded customer PII -- data with a finite black-market price. Financial services targets yield M&A transaction data, fund performance records, portfolio company valuations, and confidential legal filings -- data whose confidentiality is worth millions to its owners and whose disclosure is catastrophic for clients.

The targeting shift began in June 2026 when Google's GTIG observed UNC6671 infrastructure moving from retail-focused phishing domains to financial-services-specific patterns. By July 2026, domain registration tempo accelerated to one new AiTM phishing domain every 1.6 days, a 33% increase from the April-May average of one every 2.2 days.

Confirmed August 2026 attack attempts documented by Google and BleepingComputer include Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel, and multiple unnamed private equity firms. Point72 detected and contained the intrusion attempt with no confirmed data theft. Two Sigma blocked the attack at the portal stage. Citadel and Millennium have not confirmed breach outcomes publicly.

The operational logic is straightforward. An M&A advisory firm handling a $2 billion acquisition faces catastrophic client exposure if deal documents are leaked. A hedge fund whose proprietary trading models or LP relationships are exposed faces regulatory scrutiny and investor flight. UNC6671 targets the data whose confidentiality justifies the settlement demand, not the data whose quantity is largest.

UNC6671's attack chain spans six ATT&CK tactics with no overlap with the exploit-based techniques most enterprise detection stacks prioritize.

Initial Access (TA0001): T1566.004 -- Phishing: Spearphishing via Voice. The personal phone call is the sole initial access mechanism. UNC6671 has not been observed using email phishing, CVE exploitation, or credential stuffing for initial entry.

Credential Access (TA0006): T1539 -- Steal Web Session Cookie. The AiTM proxy intercepts the authenticated session token Microsoft 365 or Okta returns after MFA completion. T1556.006 -- Modify Authentication Process: Multi-Factor Authentication, covering the post-compromise addition of attacker-controlled MFA factors to maintain persistence.

Persistence (TA0003): T1098.005 -- Account Manipulation: Device Registration. Following initial access, operators register attacker-controlled devices in Okta or Entra ID to maintain durable access after the stolen session cookie expires.

Defense Evasion (TA0005): T1070.004 -- Indicator Removal: File Deletion. All MFA setup alerts, security notification emails, and password reset confirmations are deleted from the compromised mailbox. T1564 -- Hide Artifacts, covering the systematic removal of attacker activity from the victim's view.

Exfiltration (TA0010): T1567 -- Exfiltration Over Web Service. Automated scripts using python-requests/2.28.1 and WindowsPowerShell/5.1 bulk-access SharePoint document libraries, Exchange mailboxes, and connected SaaS platforms. T1078.004 -- Valid Accounts: Cloud Accounts, since all post-compromise activity uses the legitimately issued session token.

Impact (TA0040): T1657 -- Financial Theft via extortion, with initial demands of $1-3 million per victim and average settlements of $750,000.

Google GTIG has identified 56 AiTM phishing domains tied to UNC6671 operations across all four active brands. The nine domains listed below represent the highest-confidence indicators tied to August 2026 financial services targeting and were active as recently as August 3, 2026. Block all of them at DNS resolvers, corporate web gateways, and email security filters.

The IP infrastructure separates into two functional tiers. The AiTM reverse proxy tier (31.7.56.61 and 31.7.56.52) handles real-time credential relay at AS51852 Private Layer INC in Switzerland. The exfiltration tier (23.234.75.84 and 195.140.213.114) routes bulk data from compromised M365 tenants. The phishing backend nodes (193.34.212.132 at MEVSPACE Poland and 185.178.208.153 at DDOS-GUARD Russia) serve the portal HTML and manage AiTM sessions.

The residential proxy ASNs used for M365 and Okta authentication blending (AT&T, Comcast, Starry, Optimum) are difficult to block without false-positive impact. Focus detection on behavioral signals instead: MFA setup events within 60 seconds of an authentication failure, FileAccessed events with scripting user-agents, and session starts from known anonymizing proxy infrastructure.

Full current IOC list including all 56 domains is published by Google GTIG at the Cloud Blog post linked in sources below.

No CVE-specific Sigma rule exists for UNC6671 because the group exploits no software vulnerability. Detection must target behavioral signals: AiTM phishing blocks in Okta, legacy authentication bypass in Azure, and session starts from anonymizing proxies. Deploy these three rules against Okta system logs and Azure AD sign-in logs.

The Okta FastPass Phishing Detection rule fires when Okta FastPass identifies and blocks an AiTM phishing attempt during the authentication flow -- the most direct indicator of an active UNC6671 attack in progress.

The Legacy Authentication MFA Bypass rule catches the python-requests/2.28.1 and WindowsPowerShell/5.1 user-agents that UNC6671 uses for automated post-compromise exfiltration -- the bulk data theft phase that follows successful credential capture.

The Okta Proxy Session rule catches session starts from commercial VPNs, Tor exit nodes, and residential proxies -- the anonymization infrastructure UNC6671 uses to blend post-compromise activity with normal user traffic.

UNC6671's attack chain has no technical step that a perimeter firewall or EDR can interrupt before the employee answers the phone. Every defensive control that matters operates before the call, during identity policy enforcement, or immediately after an anomalous authentication event.