Technology and Science06 August, 20262 min read
Google Says Hackers Target US Financial Firms With Vishing Extortion, Including Groups Falcon, Helix, Pink, Redact
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Google says hackers use vishing to extort US financial firms by targeting employees. Targeted firms include Blackstone, Apollo Global Management, KKR, Bain Capital, and others.
Vishing Extortion Campaign
Google researchers said hackers are targeting large financial and investment firms in the United States by calling employees’ personal cellphones and posing as co-workers or IT helpdesk staffers to steal sensitive data for extortion. In the scheme described by Google, the attackers try to get targets to enter their credentials and multi-factor authentication codes on spoofed websites, and once those codes are captured the hackers can move deeper into corporate networks. Google identified four hacking groups—Falcon, Helix, Pink, and Redact—and said they may fall under a broader collective tracked as UNC6671.
The campaign’s financial demands typically range from $750,000 to $3 million, and Google said one cryptocurrency wallet linked to the campaign received around $10 million in bitcoin during the first few months of this year. TechCrunch reported that Google’s security researchers said the groups run websites that publicize breaches and threaten to leak stolen data unless a ransom is paid, including a message that “We conduct every negotiation on professional terms.”
Targets and Methods
Reuters, as cited by multiple outlets, said the targeted organizations include Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG. TechCrunch said Google did not name the victims, but Reuters reported that the list includes those private equity firms, while Laurie Bischel, a spokesperson for CME Group, declined to comment. The attacks, according to the reporting, used “meticulous social engineering tactics” that guided employees to booby-trapped sites named “passkeyhelpdesk” or “secure-passkey.”
BigGo Finance said the campaign lasted roughly five weeks and that the hackers created 72 malicious websites tailored to mimic legitimate login portals of specific firms. Austin Larsen, principal threat analyst at Google’s Threat Intelligence Group, said, “Sophisticated is not the right word,” adding, “It is just really effective.”
Ransom Sites and Stakes
Google said some groups operate public-facing extortion sites designed to pressure victims into paying fast, and TechCrunch quoted one site stating, “The publication of your data is never our preferred resolution.” The same quoted site added, “Respond promptly and in good faith, and the matter is resolved without further incident,” framing the extortion as a negotiation over stolen data. Google’s researchers said the groups may be part of a coordinated operation under different extortion brands, possibly to “compartmentalize operations” and “hide overall breach volumes.”
TechCrunch reported that Google said a cryptocurrency wallet associated with one of the hacking groups received around $10 million in bitcoin in the first few months of this year, while the hackers usually demand from $750,000 to $3 million from victims. In the reporting, Reuters could not establish which companies were successfully compromised, and several named firms including Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, KKR, Moody’s, and TPG did not respond to a request for comment.