Skip to content

CyberSIXT Search

Threat actor · coverage timeline

UNC6671

8 articles from 6 outlets between 15 May and 9 Sep. First reported by Google Cloud. The busiest day was Fri 7 Aug, with 3 articles.

Articles: 8; all time · from 6 outlets
Days with coverage: 6; across 118 days
Busiest day: 3; articles on Fri 7 Aug
Last 7 days: 0a day; vs 0.1 a day before
First report: 15 May; Google Cloud
CVEs named: 0; in these articles

Coverage over time

8 articles · 15 May – 9 Sep

15 MayFirst report15 May · Google Cloud

Show as table

UNC6671: articles per day
Day (UTC)	Articles	Outlets
Fri 15 May	1	Google Cloud 1
Sat 16 May	1	DataBreaches 1
Thu 6 Aug	1	Google Cloud 1
Fri 7 Aug	3	SecurityWeek 1, Security Affairs 1, The Hacker News 1
Wed 12 Aug	1	SecurityOnline 1
Wed 9 Sep	1	SecurityOnline 1

Articles

8 articles

Wed 9 Sep1 article

23:28
Hackers Use Fake IT Calls to Hijack Microsoft 365 AccountsSecurityOnline

Wed 12 Aug1 article

09:52
UNC6671 vishing gang rebrands, steals cash from banks, law firmsSecurityOnline

Fri 7 Aug3 articles

19:31
UNC6671 vishing scams use personal phones to breach SaaS accountsThe Hacker News
16:50
UNC6671 hackers pose as IT support to steal MFA from 200 firms.Security Affairs
11:10
Vishing gang rebrands, hits firms with $10M Bitcoin ransomSecurityWeek

Thu 6 Aug1 article

18:41
UNC6671 uses vishing to push Redact, Pink extortion on firmsGoogle Cloud

Sat 16 May1 article

14:22
BlackFile vishing attack steals data from Microsoft 365 and OktaDataBreaches

Fri 15 May1 article

17:16
UNC6671’s BlackFile Uses Vishing and AiTM to Bypass MFAGoogle Cloud · first report