UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
78
Threat actor
Cordial Spider
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 18, 2026
- Last mentionedSep 7, 2026
Timeline
3 articles · newest firstRansom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.
55
ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories
A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.
30
Appears with
- Oktavendor · 3
- UNC6671threat actor · 3
- Microsoftvendor · 2
- SOCRadarorganization · 1
- Settrathreat actor · 1
- Google Threat Intelligence Grouporganization · 1
- Anubisthreat actor · 1
- s5cmdproduct · 1
- The Hacker Newsorganization · 1
- ShipMonkvendor · 1
- ShinyHuntersthreat actor · 1
- GRITorganization · 1
- ServiceNow Service Portalproduct · 1
- SoftPerfect Network Scannerproduct · 1
- Helixthreat actor · 1
- Work Panelproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.