Cybercriminals Target US Financial Companies via Phone Calls

Even in the era of AI and automated cyberattacks, the simplest and most proven methods of fraudsters continue to deliver high results. According to ixbt.com, an unknown group of hackers is carrying out special cyberattacks against major financial and investment companies in the US. The main goal of these groups is to steal confidential information and extort money from victims by threatening to publish it on the internet. This is reported by Techcrunch.com reports .

A special report published by Google security researchers does not disclose the names of the victims. However, according to Reuters, leading private equity firms such as Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moodyʼs, and TPG are on this list. Experts note that such incidents indicate serious security gaps in large financial organizations.

The Vishing Method and Its Risks

These hacker groups, named Falcon, Helix, Pink, and Redact by Google, are using a very outdated yet extremely effective method to gain access to enterprises. According to this method, criminals call employees' personal cell phones and introduce themselves as colleagues or IT help desk staff. During the conversation, they try to persuade victims to enter their login credentials, passwords, and multi-factor authentication codes on fake websites. This method, known in cybersecurity as voice phishing, is called vishing.

It has been revealed that some of the hacker groups operate special websites demanding ransom under the threat of disclosing stolen data. On their websites, the criminals openly state that negotiations will be conducted professionally, that distributing data is not their primary goal, and that such measures will only be taken if cooperation is refused.

Research Results and Broad Threats

Google researchers suggest that these groups operating under various names may actually be part of a single large collective tracked as UNC6671. It is not yet fully clear whether they are independent affiliates, splinter groups, or using a single Phishing-as-a-Service infrastructure. Experts believe this is a coordinated effort to hide operations and evade accountability.

The report notes that these groups have previously targeted major companies in the manufacturing, real estate, healthcare, insurance, technology, transport, and hospitality sectors. Back then, the primary goal of the hackers was to obtain valuable intellectual property, source code, or confidential customer data.

Recently, however, attacks have been focused particularly on legal and financial organizations, especially private equity firms. The focus on organizations dealing with mergers, acquisitions, and capital allocation indicates a strategy to obtain critical corporate information that allows criminals to maximize extortion demands.