Hackers Impersonate IT Support to Breach Leading Financial Companies

Attackers associated with UNC6671 used fake IT help desks and voice phishing to steal employees’ MFA credentials and gain access to financial and other organizations. Google Threat Intelligence Group reported that the campaign operated under multiple extortion brands, including Redact, Pink, Helix, and Falcon, and targeted more than 200 companies.