Home › Threat Actors › UNC6671
← All Threat Actors
Nation-State high Unknown / unattributed to a nation-state; assessed as part of the English-speaking 'Com' criminal ecosystem.

UNC6671

Unattributed — a Google Threat Intelligence Group (GTIG) placeholder cluster designation; Mandiant has not upgraded it to a named 'FIN' actor and no nation-state sponsorship is alleged. Assessed as part of the broader English-speaking 'Com' cybercriminal ecosystem, but GTIG treats it as operationally and infrastructurally distinct from Scattered Spider (UNC3944) and ShinyHunters. · Financial — pure data-theft extortion with no ransomware encryptor; GTIG tracked roughly $10.6–10.7 million in Bitcoin proceeds between January and May 2026 alone.

Reports 1
Active Since First surfaced publicly January 2026; BlackFile brand launched February 2026
Last Reported 26 Aug 2026
Sectors Targeted finance, healthcare, critical-infrastructure, communications

Tactics, Techniques & Procedures (TTPs)

  • Vishing: operators call employees' personal mobile numbers impersonating IT helpdesks with a spoofed caller ID, using an urgent 'MFA/passkey re-enrollment' pretext
  • Victims directed to lookalike SSO portals running real-time adversary-in-the-middle reverse-proxy kits against Microsoft Entra ID / Okta
  • Victims coached by phone to relay live MFA codes, after which operators register a new attacker-controlled MFA device/passkey for durable persistence
  • Pivot via SSO into SharePoint, OneDrive, Salesforce, Zendesk, ServiceNow; keyword-targeted searches (e.g. 'confidential', 'SSN')
  • 'Direct fetch' exfiltration — reusing stolen session cookies (incl. Microsoft FedAuth tokens) to issue direct HTTP GET requests via python-requests/PowerShell, logged as lower-visibility FileAccessed rather than FileDownloaded events
  • Multi-brand data-leak-site extortion (BlackFile, then Redact, Pink, Helix, Falcon) from shared infrastructure and phishing kits; escalation via spam floods, threatening voicemails, and swatting attempts

Known Targets

Manufacturing, real estate, healthcare, insurance (early 2026)Technology, transportation, hospitality (mid-2026)Financial services, private equity, legal (mid-to-late 2026), including reported targeting of Point72, Millennium Management, Two Sigma, and CitadelGeography: North America, UK, Australia

Analyst Notes

Staged a fake 'retirement' in May 2026 while Bitcoin cashouts continued, then re-emerged under four new brands from the same infrastructure — GTIG treats all five brands as one adversary.

Also Known As

BlackFileRedactPinkHelixFalcon

MITRE ATT&CK Techniques

T1566.004 Phishing: Spearphishing Voice T1557 Adversary-in-the-Middle T1098.005 Account Manipulation: Device Registration T1213.002 Data from Information Repositories: SharePoint T1539 Steal Web Session Cookie

Intelligence Reports

Analysis financehealthcare

UNC6671: Inside the Vishing Crew Behind BlackFile, Redact, Pink, Helix, and Falcon

A single financially motivated intrusion group has spent 2026 impersonating IT helpdesks to bypass MFA at scale, quietly cycling through five extortion brands -- and this summer set its sights on Wall Street's largest hedge funds.

26 Aug 2026 · 13 min read