← Back to Feed

UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

August 6, 2026 · Google Cloud Security · Severity: MEDIUM

Google Threat Intelligence Group reveals UNC6671 has not disbanded but diversified into brands like Redact, Pink, Helix, and Falcon. They continue using vishing to target enterprises, especially financial services, by stealing credentials and exfiltrating data from cloud environments. The article details infrastructure links across these extortion brands and offers hardening guidance.

Key Takeaways

  • UNC6671 rebranded into multiple extortion fronts despite BlackFile's announced retirement in May 2026.
  • The group uses vishing via personal phones and AiTM to steal credentials and MFA tokens.
  • Targets include financial services, enterprise cloud environments, and professional services firms.
☕ Buy a Coffee