Google Links Financial Firm Hacks to Sophisticated Extortion Collective

The hacking groups—identified by Google as Falcon, Helix, Pink, and Redact—operate under a collective known as UNC6671. By posing as IT support or coworkers in calls to personal cellphones, these actors manipulate staff into surrendering login credentials and multi-factor authentication codes. Once inside, the groups exfiltrate confidential files, threatening to leak them unless victims pay ransoms ranging from $750,000 to $3 million.

Google analysts suggest this structure allows the collective to compartmentalize its activities and obscure the true scale of its breaches. The campaign has recently pivoted toward private equity firms, including Apollo Global Management, Blackstone, and KKR, likely to maximize leverage by accessing high-value merger and acquisition data. Evidence suggests the group is highly profitable; one associated cryptocurrency wallet received approximately $10 million in Bitcoin during the first few months of this year alone. While the targeted firms have remained silent, the shift toward these high-stakes organizations underscores a calculated strategy to exploit confidential corporate intelligence for maximum financial gain.