Threat actor
UNC6671
Tracked by CyberSIXT since May 15, 2026 · last activity May 16, 2026
Coverage timeline
-
BlackFile vishing attack steals data from Microsoft 365 and Oktadatabreaches.net · May 16, 2026
-
UNC6671’s BlackFile Uses Vishing and AiTM to Bypass MFAcloud.google.com · May 15, 2026