Google Warns: Cybercriminals Targeting Financial Firm Workers to Execute Hacks and Extortion Schemes

Despite advancements in AI-driven cyber threats, traditional hacking methods that exploit human vulnerabilities remain effective.

A report released by Google’s security team reveals that unidentified hacker groups are successfully infiltrating prominent financial and investment companies across the U.S. Their objective is to steal confidential information and extort victims by threatening to disclose this data.

While specific firms were not mentioned, sources indicate that significant private equity companies, including Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG are among those targeted.

Google has identified several hacker groups named Falcon, Helix, Pink, and Redact. These groups are employing a time-honored tactic: placing phone calls to employees’ cell phones, impersonating colleagues or IT personnel, to deceive individuals into providing their login credentials and multi-factor authentication codes on fraudulent websites—this method is known as voice phishing, or vishing.

Some of the gangs promote their attacks through dedicated websites, threatening to leak stolen data as a means to force victims into paying ransoms, a common tactic in the cybercrime world.

One of the sites asserts, “We negotiate professionally. Publishing your data is never our preferred option; it only happens if there is no engagement, excessive delays, or failure to comply with an agreement. Engage swiftly and sincerely to resolve the issue amicably.”

According to Google researchers, the various hacking groups may operate under a broader network referred to as UNC6671. However, it remains unclear whether they function as affiliates, splinter factions, or share the same phishing infrastructure.

The report indicated that these operations might suggest a coordinated effort by several actors managing different extortion brands to compartmentalize their activities, mask the scale of breaches, and mitigate negotiation repercussions.

Google noted that these hacker groups have previously gone after major players in sectors such as manufacturing, real estate, healthcare, and insurance, in addition to tech, transport, and hospitality industries, focusing on obtaining valuable intellectual property, software code, or sensitive client information.

Recently, the focus has shifted toward legal and financial organizations like private equity firms. The reports suggest that this strategy aims at obtaining high-stakes corporate and confidential information to bolster their extortion efforts.

Google disclosed that one cryptocurrency wallet linked to a hacker group accumulated nearly $10 million in bitcoin during the early months of this year, with ransom demands typically ranging from $750,000 to $3 million.

Neither CME Group nor representatives from the private equity firms named provided comments on the situation.