Cyberspace Extortion Groups Target U.S. Finance Firms, Google Finds

What's happened

Google researchers say multiple hacking groups, including Falcon and UNC6671, are using vishing to break into large U.S. financial firms and extort victims with threats to publish stolen data. The activity overlaps with past attacks on private equity and other sectors; ransoms have reached millions.

What's behind the headline?

Why this matters

Google’s report links multiple threat actors under a common umbrella, suggesting a coordinated operation rather than isolated incidents.
The emphasis on private equity and M&A data signals attackers see high-value targets where data disclosure could cause outsized reputational and financial damage.
The use of voice phishing (vishing) shows attackers are exploiting human factors, not just software exploits.

What to watch

Whether the UNC6671 umbrella widens to include new affiliates or branding.
The effectiveness of improved credential hygiene and MFA in reducing success rates for such campaigns.
Potential policy responses from regulators as data exfiltration remains a key corporate risk.

How we got here

The incidents build on long-term patterns of phishing and credential theft aimed at high-value sectors. Google’s analysis groups several attacker personas under UNC6671 and notes a shift toward mergers, acquisitions, and confidential data as leverage for extortion.

Our analysis

Google’s security researchers have identified several extortion-focused groups (Falcon, Helix, Pink, Redact) operating under an umbrella labeled UNC6671, with targets spanning financial services, manufacturing, and real estate. Reuters has reported that Apollo Global Management, Bain Capital, Blackstone, and others are among the alleged victims. The report notes ransoms typically range from $750,000 to $3 million, with some cryptocurrency wallets collecting millions in a short period. Google did not name specific victims in the report.

Go deeper

What organizations can you point to that have faced vishing-led breaches recently?
How can firms bolster defenses without disrupting operations during mergers?
Are regulators moving toward stricter penalties for extortion tied to stolen data?”],
scores