UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
78
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 13, 2026
- Last mentionedSep 7, 2026
Timeline
3 articles · newest firstDetails emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
70
Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!
Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.
75
Appears with
- Googlevendor · 3
- BlackFilethreat actor · 3
- Google Threat Intelligence Grouporganization · 3
- Helixthreat actor · 2
- Falconthreat actor · 2
- UNC6671threat actor · 2
- Mandiantvendor · 2
- Pinkthreat actor · 2
- Mandiantorganization · 2
- Luna Moththreat actor · 1
- Moody'sorganization · 1
- BlackFileorganization · 1
- SOCRadarorganization · 1
- WilmerHaleorganization · 1
- Goodwin Procterorganization · 1
- ShinyHuntersthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.