Automated evidence cluster

UNC6671: Financial services targeting activity

Automatically correlated reporting linking UNC6671 to activity affecting Financial services. Review the supporting sources before treating attribution as confirmed.

55% correlation confidence.This grouping supports investigation. It is not a definitive attribution or a vendor-assigned campaign name.

1Reports

1Sources

49Highest signal

6 Aug 2026Latest activity

Actors in supporting reports

UNC6671

Supporting evidence

Google Threat Intelligence Group · 6 Aug 2026

UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments ↗

Written by: Tyler McLellan, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry…