Google says hackers call financial firm employees in extortion scheme

Even in an era defined by autonomous cyberattacks powered by artificial intelligence, crude and time-tested social engineering techniques continue to yield massive success for threat actors. According to a security report published by Google researchers, unknown hacking groups are actively targeting large financial and investment institutions across the United States with the ultimate objective of stealing sensitive corporate data to extort victims under the threat of public leaks.

Although Google did not publicly name the affected organizations, Reuters reported that the targets include prominent private equity giants such as Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG. Google’s threat intelligence tracks these specific hacking factions under the designations Falcon, Helix, Pink, and Redact.

Stock photo for illustration only, not from the actual event

These syndicates rely on a conventional method known as voice phishing, or vishing. Attackers place phone calls directly to the personal cellular devices of corporate employees, impersonating coworkers or IT helpdesk staff to manipulate targets into entering their credentials and multi-factor authentication codes onto spoofed domains. Furthermore, certain factions operate dedicated websites designed to publicize their breaches and threaten data leaks as leverage to force ransom payments.

"We conduct every negotiation on professional terms. The publication of your data is never our preferred resolution; it is the consequence of refusal to engage, deliberate stalling, or failure to honor an agreement."

Hacking group statement

Google researchers stated that these distinct operational cells likely belong to a broader umbrella collective tracked internally as UNC6671. However, uncertainty remains regarding whether they operate as formal affiliates, splinter cells, or separate entities leveraging the same Phishing-as-a-Service infrastructure. The report suggests this multi-brand approach serves as a coordinated strategy to compartmentalize operations, obscure total breach volumes, and isolate negotiation fallouts.