UNC6671: Vishing to Adversary in the Middle SaaS Extortion - Multi Brand Operation Bypassing MFA to Steal Cloud Data from Financial Services

UNC6671 is a financially motivated criminal cluster that ran publicly as BlackFile from early 2025, announced a false shutdown in May 2026, and re-emerged operating four extortion brands in parallel: Redact, Pink, Helix, and Falcon. The same infrastructure, affiliate network, and vishing scripts sit behind all of the brands, a deliberate structure that lets one front continue while another draws law enforcement attention. Okta tracks the same activity as CORDIAL SPIDER. Through 2026 the targeting narrowed from broad opportunistic sectors toward financial services, private equity, law firms, and merger and acquisition advisors, the organizations whose confidential data commands the highest extortion leverage, and named intrusion attempts against several large hedge funds were reported in August 2026.

Initial access is voice phishing rather than malware or exploitation. Operators single out staff in identity management, helpdesk, and IT administration roles by title, register a victim branded lookalike domain themed around passkey, SSO, or MFA enrollment within hours, then call the employee on a personal mobile phone while spoofing the corporate helpdesk number. The pretext claims an urgent, mandatory passkey enrollment or MFA upgrade. The victim is steered to an adversary in the middle portal that mirrors the organization's real single sign on page and transparently proxies every entry to the legitimate Microsoft 365 or Okta endpoint. When the victim completes multi factor authentication the proxy captures the authenticated session cookie the identity provider returns, so push, SMS one time passcode, and time based one time passcode factors are all defeated and the attacker holds a live, multi factor verified session.

Once authenticated the operators work to make access durable and quiet. They register attacker controlled devices or add attacker controlled authenticators in Okta or Entra ID so access survives session expiry, and they blend follow on activity through residential proxy address space and commercial VPN exit nodes to match the victim's normal geography. Bulk collection follows: automated scripts driven by scripting and automation user agents such as python requests, Windows PowerShell, and Go http client access SharePoint document libraries and Exchange mailboxes at volumes far above human browsing, and data is staged out to attacker cloud storage. To slow discovery the operators delete the multi factor enrollment confirmations, password reset notices, and security alert emails generated during the intrusion from the compromised mailbox, and the victim commonly learns of the breach only when the extortion demand arrives.

The supporting infrastructure ties the brands together and follows a recognizable pattern. Root domains are registered through a small set of registrars and combine authentication themed keywords such as passkey, sso, and mfa with enrollment verbs like setup, activate, deploy, and enroll, with victim specific subdomains layered underneath. Adversary in the middle reverse proxies and phishing backends cluster on a handful of hosting providers including a Swiss virtual private server range, while separate nodes handle automated software as a service exfiltration. Domain provisioning ran at roughly one new phishing domain every one and a half to two days, with a surge of seven domains inside seventy two hours in late July 2026 that signalled an accelerating operation.

Beyond the domains published in the original reporting, Vega threat research pivoted on the identified infrastructure and surfaced additional related domains, including further victim branded phishing page domains and Work Panel operator console domains; these indicators appear in the indicator list below.