UNC6783

UNC6783 is a financially motivated threat actor tracked by Google Threat Intelligence Group (GTIG), potentially tied to the "Raccoon" persona. GTIG reported that the group has targeted several dozen high-value corporate entities across multiple sectors. The actor primarily focuses on compromising business process outsourcers (BPOs), call centers, and support/helpdesk functions to obtain trusted access into downstream customer environments, and has also directly targeted support and helpdesk staff at victim organizations. Observed tradecraft includes targeted social engineering and phishing campaigns conducted via live chat, directing victims to spoofed Okta login pages hosted on domains impersonating the target organization, frequently using patterns such as <org>[.]zendesk-support<##>[.]com. GTIG reported that UNC6783 uses a phishing kit capable of stealing clipboard contents to bypass standard MFA and then enroll attacker-controlled devices for persistent access. The group has also used fake security software updates to trick victims into downloading remote access malware. Following data exfiltration, UNC6783 has sent ransom notes using Proton Mail/ProtonMail accounts as part of data theft extortion operations. Reporting also notes suspected links to the "Raccoon" or "Mr. Raccoon" persona in relation to attacks involving BPO compromise and helpdesk-focused social engineering, but those links are described as potential or suspected rather than confirmed.