securityonline.info 8/12/2026, 9:52:35 AM · external

UNC6671 vishing gang rebrands, steals cash from banks, law firms

UNC6671 vishing gang rebrands, steals cash from banks, law firms
Developing story incident 3 articles tracked
UNC6671 vishing gang rebrands, uses AiTM phishing for extortion
CyberSIXT Evidence Panel
Primary Source cloud.google.com
Threat Actor

THE page reports on the UNC6671 vishing extortion group's activities, revealing that they have rebranded after the claimed retirement of their BlackFile brand, now operating under names like Redact, Pink, Helix, and Falcon. They utilize voice phishing to steal credentials and exfiltrate data, primarily targeting financial services and law firms, with over 141.65 BTC ($10.69M) tracked in payments.

Although they are linked as a single group via shared phishing tactics and infrastructure, some claims suggest splintering among affiliates. Defenses against their attacks focus on phishing-resistant authentication methods and monitoring for suspicious activity.

View Primary Source Via securityonline.info

Article by CyberSIXT

Timeline Coverage

Swipe to explore timeline