One Crew, Six Hedge Funds: How UNC6671 Is Raiding Finance With Fake Help-Desk Calls

A single extortion crew called UNC6671 is responsible for a wave of financially devastating intrusions at some of the most closely watched names in global finance, Google's Threat Intelligence Group confirmed in mid-2026.

What happened, and who was hit?

Google's Threat Intelligence Group (GTIG) has attributed recent attacks on Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel, and multiple private-equity firms to one core group it tracks as UNC6671. The same operators previously ran an extortion brand called BlackFile, which first appeared in February 2025, before cycling through at least four successor brands: Redact, Pink, Helix, and Falcon.

Point72 confirmed to investors that it had been attacked but said it found no evidence of client data theft. Two Sigma said it blocked the intrusion attempt before data left its environment. Mandiant, Google's incident-response arm, was simultaneously working with several dozen other breached organisations as of the time of writing.

Between January and May 2026, GTIG tracked more than $10.6 million in Bitcoin flowing to wallets tied to the group. Opening ransom demands reached $3 million per victim. In practice, most negotiations settled around $750,000.

How did the attackers get in?

UNC6671 used voice phishing, commonly called vishing, to trick employees into surrendering credentials. Callers posed as internal IT help-desk staff, then directed targets to fraudulent login pages that harvested passwords and live session cookies simultaneously.

The pretext was consistent: the caller told employees they needed to re-enrol a passkey or update their multi-factor authentication. This framing is deliberate. It creates urgency, exploits familiarity with real IT onboarding procedures, and gives the victim a plausible reason to click a link sent during the call.

The fake pages were adversary-in-the-middle phishing kits. Instead of simply collecting a password and stopping, these kits proxy the real login flow in real time, copying the session cookie the moment the victim authenticates. A session cookie is the small file a browser holds after a successful login; it signals to a web application that the user has already passed authentication. Steal a fresh one and the attacker bypasses the password and any second-factor code entirely. MFA becomes irrelevant once that token is in the attacker's hands.

What did attackers do once inside?

After authenticating with stolen session cookies, attackers accessed Microsoft 365 or Okta single sign-on dashboards and pulled data from every cloud service connected to those accounts. Automated tooling handled bulk data exfiltration. The operators also deleted security alerts and password-reset notifications from victims' inboxes to delay detection and give themselves additional dwell time.

Then came the extortion demand.

GTIG noted the tactics bear surface-level resemblance to Scattered Spider, tracked internally as UNC3944, a separate crew known for help-desk impersonation. Infrastructure patterns, domain naming conventions, and extortion branding differ enough that Google treats UNC6671 as a distinct operation with its own tradecraft.

Why did standard security controls fail here?

The failure chain in these incidents is textbook, yet it keeps recurring because it targets the one layer that technical controls cannot fully replace: human judgment under social pressure.

MFA was almost certainly deployed at every firm named. It did not stop these attacks. The adversary-in-the-middle approach captures session tokens after authentication completes, meaning the second factor had already been satisfied by the time the attacker took control. This is a known limitation of TOTP codes and push-notification MFA when combined with real-time phishing proxies. Phishing-resistant MFA methods such as FIDO2 passkeys, which bind the authentication credential to the legitimate domain, are not vulnerable to this class of attack in the same way, because the passkey will simply refuse to respond to an attacker-controlled domain.

Yet the deeper failure is social-engineering awareness at the telephony layer. Most security-awareness programmes invest heavily in email phishing simulations and comparatively little on vishing scenarios. In security-awareness training settings, practitioners consistently observe that employees who correctly flag a suspicious email will often comply with an almost identical request delivered by a confident, authoritative-sounding caller. The phone creates a real-time social contract that email does not. People want to be helpful. They do not want to be the person who refused to cooperate with IT during an apparent security emergency.

That gap is exactly what UNC6671 exploits. Building vishing awareness into a training programme, including drills where employees receive unexpected calls from a simulated help desk and must verify the caller's identity through an out-of-band channel, closes a hole that no firewall rule can address. Exploring how a structured security-awareness curriculum handles social-engineering scenarios across channels is a useful starting point for any security team re-evaluating its training coverage.

What should security and IT teams do right now?

Several steps follow directly from how UNC6671 operates.

First, deploy phishing-resistant MFA wherever possible. FIDO2 and hardware security keys do not respond to adversary-in-the-middle proxies the way push notifications and TOTP codes do. NIST SP 800-63B classifies these as the highest-assurance authenticator options available.

Second, implement session-token controls. Short session lifetimes, continuous re-authentication triggers for sensitive operations, and anomalous-login detection (particularly logins from unexpected geolocations or IP ranges immediately after an MFA event) all reduce the window an attacker has to exploit a stolen cookie.

Third, train employees specifically on IT help-desk impersonation. Awareness programmes should include a clear, practised verification procedure: if you receive an unexpected call from IT, end the call, look up the number from the official internal directory, and call back. That single habit, if internalised, disrupts the opening move in every UNC6671 intrusion documented so far.

Fourth, harden Okta and Microsoft 365 configurations. Audit which third-party applications are connected to your SSO environment. A broad OAuth footprint means that a single compromised session can touch a far larger data surface than it should.

Austin Larsen, a principal threat analyst at GTIG, put it directly: "GTIG assesses that a single core intrusion group is driving the helpdesk vishing and cloud data theft across these various public extortion brands."

The Verizon 2024 Data Breach Investigations Report found that 68 percent of breaches involved a human element, a figure that includes social engineering, errors, and misuse. UNC6671 is simply running one of the most financially efficient versions of that attack pattern seen in recent memory. The techniques are not new. The discipline, targeting, and profit margins are.

What should employees do if they get one of these calls?

Hang up. Do not click any link sent during an unsolicited call from someone claiming to be your IT team. Call your real help desk using a phone number from your company's official directory or intranet, not a number the caller gives you. That verification step is the single most effective individual control against this campaign.

If you believe you may have already been targeted, report it to your security team immediately without waiting to confirm whether anything bad happened. Early reporting is where security-awareness programmes pay their clearest dividend: an employee who has practised the reporting habit reduces dwell time, and dwell time is what separates a contained incident from the kind that ends up on a regulator's desk.