UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

TL;DR

UNC6671 has rebranded and expanded its extortion tactics, targeting financial services and enterprise cloud environments through multiple fronts, including Redact and Pink. Despite claims of retirement, the group continues to engage in data theft and extortion activities.

Key Takeaways

• Enforce phishing-resistant multi-factor authentication across all platforms.
• Integrate SaaS applications with a standard single sign-on solution.
• Monitor logs for unusual authentication patterns and abandoned challenges.
• Restrict access to corporate-managed devices to reduce attack surfaces.