Loading threat actor…
UNC6671 is a financially motivated cybercriminal activity cluster conducting voice-phishing-led cloud data theft and extortion campaigns. Also tracked as CORDIAL SPIDER, the cluster is associated with the BlackFile, Helix, Falcon, Pink, and Redact extortion brands. These brands do not necessarily represent interchangeable actor identities. UNC6671 has targeted financial institutions, hedge funds, private equity firms, legal and professional services organizations, and enterprises in technology, transportation, hospitality, manufacturing, healthcare, insurance, and real estate. Operators impersonate corporate IT helpdesk personnel, frequently calling employees on personal mobile phones and sometimes spoofing legitimate helpdesk numbers. They invoke urgent security migrations or mandatory passkey, MFA, and single sign-on updates to direct victims to organization-branded phishing portals. Adversary-in-the-middle infrastructure captures passwords, MFA tokens, and authenticated sessions, which operators reuse to access Microsoft 365, Okta-connected applications, and other enterprise cloud resources. Associated operations also use device-code phishing. After compromise, operators enumerate accessible accounts, applications, and cloud data, then automate collection and exfiltration of documents and email. They maintain access through stolen sessions and account-security changes, including attacker-controlled MFA enrollment. Residential proxies disguise malicious sign-ins, while deletion of security notifications and password-reset messages conceals account abuse. Extortion relies on threats to disclose stolen information, including publication through associated brands' leak sites, rather than requiring encryption of victim systems. UNC6671 has substantial tradecraft overlap with Arctic Wolf's PREY-0058 cluster, but the designations are not established as equivalent. Its relationship to ShinyHunters remains unresolved; shared social-engineering techniques or extortion branding alone do not establish a common actor identity.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
162 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.