Threat actor
UNC6671
Malpedia aka UNC6671/BlackFile
Tracked by CyberSIXT since May 15, 2026 · last activity Sep 9, 2026
Coverage timeline
RSS-
Hackers Use Fake IT Calls to Hijack Microsoft 365 Accountssecurityonline.info · Sep 9, 2026
-
UNC6671 vishing gang rebrands, steals cash from banks, law firmssecurityonline.info · Aug 12, 2026
-
UNC6671 vishing scams use personal phones to breach SaaS accountsthehackernews.com · Aug 7, 2026
-
UNC6671 hackers pose as IT support to steal MFA from 200 firms.securityaffairs.com · Aug 7, 2026
-
Vishing gang rebrands, hits firms with $10M Bitcoin ransomwww.securityweek.com · Aug 7, 2026
-
UNC6671 uses vishing to push Redact, Pink extortion on firmscloud.google.com · Aug 6, 2026
-
BlackFile vishing attack steals data from Microsoft 365 and Oktadatabreaches.net · May 16, 2026
-
UNC6671’s BlackFile Uses Vishing and AiTM to Bypass MFAcloud.google.com · May 15, 2026