Blackstone, KKR and CME targeted in vishing wave tied to BlackFile crew
Google LLC’s Threat Intelligence Group today said the extortion crew behind the retired BlackFile brand has spent June and July working its way through private equity firms, law firms and financial services companies. Reuters reports that the phishing domains registered for the campaign name their intended victims. Blackstone Inc., KKR & Co. Inc., Apollo Global […] The post Blackstone, KKR and…
Cybercriminals, operating under the BlackFile brand, have been targeting private equity firms, law firms, and financial services companies with vishing attacks in June and July. The group, identified as UNC6671, also attempted intrusions at hedge funds Point72 Asset Management LP, Citadel LLC, Millennium Management LLC, and Two Sigma Investments LP.
The extortion crew uses voice phishing calls, where spoofed numbers mimic corporate IT help desks, to demand FIDO2 passkey enrollment or multifactor updates. Upon compliance, phishing links lead to subdomains resembling the employer's website, harvesting passwords and session tokens. Once inside, the crew deletes password reset confirmations and MFA configuration alerts, then exfiltrates data through automated scripts.
Google identified 18 wallets linked to BlackFile, with $10.7 million flowing into them from January to May. Demands ranged from $1 million to $3 million, with negotiations typically ending near $750,000. The surge in phishing domain registrations accelerated in April and May, with one domain appearing every 1.6 days. The Financial Industry Regulatory Authority has contacted member firms regarding the threat.
Security experts advise verifying calls using hardware-based solutions like FIDO2 keys, daily reauthentication, and blocking logins from unmanaged devices.
Written by urgent.news from SiliconANGLE's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
