UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
MentionsGoogle
Written by: Tyler McLellan, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026.
Summary from Google Threat Intelligence.
Explained
The technology and terms in this story. Learn more
- AttackPhishingMessages that impersonate someone trusted to get people to click, log in or pay.
- AttackData extortionStealing data and threatening to publish it unless the victim pays.
- DefenceMFA · Multi-factor authenticationRequiring a second proof besides a password, such as an app prompt, a code or a security key.